Wp Rentals
Monthly
Insecure Direct Object Reference (IDOR) in the WP Rentals WordPress theme (versions before 3.16.0) allows authenticated low-privileged users to manipulate user-controlled keys to access, modify, or delete rental objects-listings, bookings, or similar records-belonging to other platform users. The flaw, reported by Patchstack and classified as CWE-639, stems from the theme failing to verify server-side that the requesting user owns or is authorized to act on the referenced resource. No active exploitation or public exploit code has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the WP Rentals WordPress theme (versions before 3.16.0) allows authenticated low-privileged users to manipulate user-controlled keys to access, modify, or delete rental objects-listings, bookings, or similar records-belonging to other platform users. The flaw, reported by Patchstack and classified as CWE-639, stems from the theme failing to verify server-side that the requesting user owns or is authorized to act on the referenced resource. No active exploitation or public exploit code has been identified at time of analysis.