What is the CVSS score of CVE-2026-3460?

CVE-2026-3460 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3460?

Organizations using for WordPress is vulnerable to Insecure Direct Object Reference in all should be aware of moderate risk from CVE-2026-3460, a input validation vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-3460?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Insecure Direct Object Refere and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-3460

EUVD-2026-14186 MEDIUM

Improper Input Validation (CWE-20)

2026-03-21 Wordfence

GHSA-xxxv-phx4-9pvx

Information Disclosure WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14186

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 5.3

DescriptionCVE.org

The REST API TO MiniProgram plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2. This is due to the permission callback (update_user_wechatshop_info_permissions_check) only validating that the supplied 'openid' parameter corresponds to an existing WordPress user, while the callback function (update_user_wechatshop_info) uses a separate, attacker-controlled 'userid' parameter to determine which user's metadata gets modified, with no verification that the 'openid' and 'userid' belong to the same user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary users' store-related metadata (storeinfo, storeappid, storename) via the 'userid' REST API parameter.

AnalysisAI

The REST API TO MiniProgram plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated attackers with Subscriber-level access to modify arbitrary users' WeChat shop metadata by exploiting a permission validation flaw. The vulnerability affects all versions up to and including 5.1.2, where the permission callback validates one parameter (openid) but the actual modification function uses a different attacker-controlled parameter (userid) without cross-validation. Attackers can exploit this via the REST API to alter storeinfo, storeappid, and storename fields for any user account, potentially disrupting store operations or impersonating legitimate shop owners.

Technical ContextAI

The vulnerability resides in the REST API endpoint implementation of the REST API TO MiniProgram plugin (CPE: cpe:2.3:a:xjb:rest_api_to_miniprogram:*:*:*:*:*:*:*:*), specifically in the ram-rest-weixin-controller.php file. The flaw is rooted in CWE-20 (Improper Input Validation) and manifests as a classic authorization bypass pattern where two separate user identifiers are used inconsistently across the authentication and execution layers. The permission callback function update_user_wechatshop_info_permissions_check validates that the openid parameter corresponds to a valid WordPress user, establishing authentication context. However, the callback function update_user_wechatshop_info processes a separate userid parameter sourced directly from user input without verifying that the openid and userid belong to the same user account. This decoupling of validation logic from execution logic, combined with the REST API's parameter handling in WordPress, creates an IDOR condition where any authenticated user can manipulate the userid parameter to target arbitrary user accounts.

RemediationAI

Upgrade the REST API TO MiniProgram plugin to a version newer than 5.1.2 as soon as a patched release is available from the plugin developer; monitor the official WordPress plugin repository for security updates. The immediate fix involves modifying the permission callback to validate that both the openid and userid parameters correspond to the same user account before processing any metadata modifications, ensuring that authenticated users cannot modify other users' data. Until a patch is available, implement temporary mitigations: restrict REST API access to authenticated users only via server-level rules (disable anonymous REST API access if not required), implement IP-based access controls to limit who can access REST API endpoints, disable user registration if not actively required to reduce the number of potential attackers, and audit user metadata via direct database queries to detect unauthorized modifications to storeinfo, storeappid, or storename fields. Additionally, consider temporarily disabling the REST API endpoints for WeChat shop metadata if they are not actively in use, using must-use plugins or .htaccess rules to block requests to the affected endpoints. Reference the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7129d8cf-6b7d-4b7b-bd6a-85176247ab29?source=cve for additional details and monitoring recommendations.