Insecure Direct Object References in SiteSkite by WordPress
CVE-2026-93513

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Siteskite
Vendor
CVE Published:
23 September 2026

What is CVE-2026-93513?

The SiteSkite plugin for WordPress, specifically versions up to 2.1.7, contains a vulnerability characterized by Insecure Direct Object References (IDOR). This weakness can allow unauthorized users to access sensitive data or actions by manipulating object identifiers. It emphasizes the importance of validating user inputs to prevent unintended data exposure and strengthen overall security measures.

Affected Version(s)

SiteSkite <= 2.1.7

References

https://patchstack.com/database/wordpress/plugin/siteskit...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nixxies | Patchstack Bug Bounty Program
.