{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40737", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-15T09:19:28.916Z", "datePublished": "2026-04-15T10:21:34.150Z", "dateUpdated": "2026-04-15T10:21:34.150Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "compe-woo-compare-products", "product": "COMPE", "vendor": "VillaTheme", "versions": [{"changes": [{"at": "1.1.5", "status": "unaffected"}], "lessThanOrEqual": "1.1.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Ali Osman ERBAS (0110m4n) | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-15T12:20:46.214Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects COMPE: from n/a through <= 1.1.4.</p>"}], "value": "Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects COMPE: from n/a through <= 1.1.4."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-15T10:21:34.150Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/compe-woo-compare-products/vulnerability/wordpress-compe-plugin-1-1-4-insecure-direct-object-references-idor-vulnerability?_s_id=cve"}], "title": "WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability"}}}

{}

{}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T12:22:06.382666+00:00", "value": {"mitigation_remediation": ["Update COMPE to the latest available version or to any release newer than 1.1.4 to ensure the IDOR fix is installed", "After updating, review the plugin\u2019s permission settings to confirm that solely authenticated users can view or modify comparison lists; adjust role capabilities if necessary", "Deploy a web\u2011application firewall rule to detect and block malformed or suspicious requests that target the key parameter, reducing the window for exploitation until a patch is applied"], "summary": {"action": "Patch Now", "impact": "Authorization Bypass through User Controlled Key exposing sensitive data or actions"}, "threat_synthesis": {"affected_systems": "The vulnerability applies to the VillaTheme COMPE compe\u2011woo\u2011compare\u2011products plugin for WordPress, versions up through and including 1.1.4. Custom installations of this plugin that have not upgraded past these versions are susceptible.", "description_and_impact": "The IDOR flaw in the VillaTheme COMPE WordPress plugin allows an attacker to manipulate a user\u2011controlled key used to locate resources such as comparison lists. Based on the description, the likely attack vector is constructing HTTP requests that supply the key; the plugin does not properly verify ownership, letting a user retrieve or modify objects they are not entitled to access, thereby compromising confidentiality and integrity of that data.", "risk_and_exploitability": "The vulnerability permits direct unauthorized access to protected objects via predictable URLs or query parameters. Based on the description, the likely attack vector is an attacker guessing or enumerating the key across the network by sending crafted requests. No EPSS score is currently published, and the vulnerability is not recorded in the CISA Known Exploited Vulnerabilities catalog, suggesting that the exploitation risk may be moderate but still real. An attacker with the ability to guess or enumerate the key can exploit this weakness over the network by crafting a URL or API request that targets another user\u2019s resources, potentially escalating to further compromise of the site if combined with additional weaknesses."}}}}, "created": "2026-04-15T13:44:58.886005+00:00", "updated": "2026-04-15T13:44:58.886024+00:00", "vendors": []}