Insecure Direct Object Reference in REST API TO MiniProgram Plugin for WordPress

CVE-2026-3460

What is CVE-2026-3460?

The REST API TO MiniProgram plugin for WordPress contains an Insecure Direct Object Reference vulnerability that allows authenticated attackers with Subscriber-level access or higher to manipulate unrelated users' store-related metadata. This issue arises from a failure to properly validate the 'openid' and 'userid' parameters; while the 'openid' parameter corresponds with a legitimate WordPress user, the 'userid' parameter can be controlled by the attacker. Thus, an attacker can exploit this vulnerability through the 'userid' REST API parameter to alter sensitive user data such as store information, store app IDs, and store names, leading to potential data breaches and unauthorized access.

References