Modal Survey
Monthly
Insecure Direct Object Reference (IDOR) in the Modal Survey WordPress plugin (versions up to and including 2.0.2.2.3) allows authenticated subscribers to bypass authorization controls and access survey objects belonging to other users by manipulating user-controlled keys in requests. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting the attack surface to sites with open registration or with existing low-privilege user accounts. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the Modal Survey WordPress plugin (versions up to and including 2.0.2.2.3) allows authenticated subscribers to bypass authorization controls and access survey objects belonging to other users by manipulating user-controlled keys in requests. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting the attack surface to sites with open registration or with existing low-privilege user accounts. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.