EUVD-2026-48221
GHSA-w925-7c2x-wmj7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable IDOR requiring contributor auth (PR:L); only limited data disclosure (C:L), no write or availability impact confirmed.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.
AnalysisAI
Product Slider for WooCommerce plugin (versions ≤1.13.62) exposes an Insecure Direct Object Reference flaw that allows authenticated contributors to access WooCommerce objects beyond their authorization scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms network-reachable exploitation requiring only a low-privilege contributor account, resulting in limited confidentiality disclosure with no integrity or availability impact. No public exploit code and no CISA KEV listing are present at time of analysis, placing this in the 'monitor and patch' category rather than emergency response.
Technical ContextAI
The vulnerability is rooted in CWE-639 (Authorization Through User-Controlled Key), the canonical IDOR weakness class, where the plugin uses a caller-supplied identifier - such as a post ID, product ID, or slider object key - to retrieve data without verifying that the requesting user holds authorization over that specific object. The affected product is the PickPlugins 'Product Slider for WooCommerce' WordPress plugin (CPE: cpe:2.3:a:pickplugins:product_slider_for_woocommerce:*:*:*:*:*:*:*:*), a front-end carousel/slider extension layered on top of WooCommerce's object model. WordPress contributor roles are typically granted to content authors who cannot publish posts without editor approval, making this role accessible in multi-author WordPress installations. The flaw exists because the plugin fails to enforce per-object ownership or capability checks when a contributor submits a request referencing an arbitrary object reference, allowing enumeration or retrieval of otherwise inaccessible data.
RemediationAI
The primary remediation is to update the Product Slider for WooCommerce plugin to a version beyond 1.13.62; however, no exact patched release version is confirmed in the available data - administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-products-slider/vulnerability/wordpress-product-slider-for-woocommerce-plugin-1-13-62-insecure-direct-object-references-idor-vulnerability for the current fixed release. As a compensating control pending a patch, site administrators should audit contributor-role accounts and restrict the contributor role to only fully trusted users, since exploitation requires at minimum a contributor account. Disabling user registration or requiring manual approval for new accounts reduces the attack surface on public-facing sites. If the plugin is not actively used, temporarily deactivating it eliminates the risk entirely without impacting core WooCommerce functionality.
The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did n
The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcod
The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of i
The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some o
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Produc
Authenticated users can bypass authorization checks in PickPlugins Product Slider for WooCommerce version 1.13.60 and ea
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today