EUVD-2026-85501
GHSA-xxjp-2jq6-mmwv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin endpoint over network
-
ExploitEnumerate/substitute object ID parameter
-
ExecutionServer returns object without authorization check
-
ImpactRead unauthorized team-object data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default installations of the RadiusTheme 'TLP Team' WordPress plugin at versions <=6.0.0. The only requirement is that the plugin be installed and its vulnerable endpoint network-reachable; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed. Exploitation is limited by the impact ceiling: the flaw discloses only limited object data (C:L) and cannot modify data or disrupt service, so realistic risk is information disclosure of individual team-object records rather than site compromise. |
| Impact | This is a moderate-severity, confidentiality-only issue whose signals are internally consistent rather than alarming. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) describes an unauthenticated, network-reachable IDOR (CWE-639) that leaks limited data (C:L) with no integrity or availability impact - a broken object-level authorization flaw, not code execution or full data compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis' and there is no SSVC decision content to weigh. The C:L/I:N/A:N impact caps real-world damage at disclosure of individual object records the attacker should not see (e.g. enumerating team-member entries or IDs), which is why the score sits at Medium despite PR:N/UI:N. Net: a legitimate but low-priority patch item - real because it is unauthenticated and trivial to reach, but bounded because it exposes only limited information and enables no takeover. Note the 'Authentication Bypass' tag is misleading: CWE-639 is a missing-authorization/IDOR weakness, not an authentication bypass. |
| Exploit ScenarioDerived | An unauthenticated attacker sends crafted HTTP requests to the affected TLP Team plugin endpoint, incrementing or substituting an object identifier that the plugin fails to authorize against the requester. This lets them retrieve team-object records they should not have access to, disclosing limited stored information. No public proof-of-concept is available in the provided data, and the low complexity (AC:L) plus no-auth (PR:N) requirement make the request itself trivial to script. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated insecure direct object reference in the RadiusTheme 'TLP Team' WordPress plugin (versions 6.0.0 and earlier, CPE cpe:2.3:a:oleh_radiustheme:team) lets remote attackers retrieve team-member record data without logging in or interacting with the site, because a user-controlled object key is trusted without an ownership or capability check. Per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector, the flaw is confidentiality-only: an attacker can read limited object data but cannot alter content, escalate privileges, or cause denial of service, so realistic impact is disclosure of individual team entries rather than full site compromise. No public exploit code was identified at time of analysis and the plugin is not listed in CISA KEV; exploitation requires only that the plugin be installed on a network-reachable WordPress instance, making this a moderate, patch-when-convenient exposure rather than an urgent one.
RemediationAI
No vendor-released patched version is identified in the available data, so the concrete first step is to check the TLP Team plugin page in the WordPress.org repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/tlp-team/vulnerability/wordpress-team-plugin-6-0-0-insecure-direct-object-references-idor-vulnerability) for a release newer than 6.0.0 and update as soon as one is published; the EUVD record EUVD-2026-85501 tracks the same affected range. Until an upgrade is confirmed, compensating controls are practical because the flaw is a read-only IDOR with no integrity or availability impact: deactivate and remove the TLP Team plugin entirely if team listings are not business-critical, which eliminates the exposure at the cost of losing those pages; or, if the plugin must stay, restrict access to its front-end AJAX/REST endpoints at the edge (WAF or reverse-proxy rule matching the plugin's action/route parameters) to block anonymous enumeration of object identifiers, accepting that legitimate public team pages may break if they rely on the same endpoint. Because exploitation requires no authentication, IP allowlisting is not a workable control for a public-facing site, and rate limiting only slows enumeration rather than stopping it. Note that removal of the vector does not address any cached or indexed object data already disclosed; review access logs for sequential identifier requests against the plugin's endpoints to gauge whether enumeration occurred, and monitor the Patchstack advisory for the fixed version number before applying it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-639 (Authorization Bypass Through User-Controlled Key) weakness in a WordPress plugin. WordPress plugins typically expose AJAX actions (admin-ajax.php) or REST routes that accept an object identifier - a post ID, term ID, or custom record key - from the request. A correct implementation pairs that lookup with an authorization check (current_user_can(), a nonce, or an ownership comparison), but TLP Team at 6.0.0 and earlier appears to fetch the referenced team object directly from the supplied key, so any anonymous visitor who can guess or enumerate identifiers receives the associated record. Because the endpoint is reachable over the network and the CVSS vector carries PR:N/UI:N, no account and no victim interaction are needed; the 'Insecure Direct Object References' tag and the Patchstack-sourced report confirm this is the disclosure path. The impact is bounded by the C:L component - only limited, non-sensitive object data is exposed - and there is no integrity (I:N) or availability (A:N) component, meaning the attacker cannot write, delete, or degrade the site through this vector. The affected code ships as the 'TLP Team' plugin authored by Oleh (RadiusTheme), distributed through the WordPress.org plugin ecosystem, which means the installed base is broad and version discovery is trivial via standard plugin fingerprinting.
Know when Team gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network-reachable IDOR (PR:N/AV:N/AC:L) leaking limited object data only, so C:L with I:N/A:N and unchanged scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A missing authorization vulnerability exists in RadiusTheme Team plugin (versions up to 5.0.11) that allows attackers to
Metric name injection in Net::Async::Statsd::Client (Perl, versions through 0.005) allows network-reachable, unauthentic
Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team
RadiusTheme Team versions up to 5.0.13 contain an access control misconfiguration that allows unauthenticated remote att
The Team - Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capab
Exploit-DB