WP Document Revisions <= 5.6.0 - Authenticated (Contributor+) Insecure Direct Object Reference to Media File Rename and Deletion via Validate Structure Endpoint
- ID
- WPSEC-2026-0073
- Plugin
- WP Document Revisions (wp-document-revisions)
- Affected
- from 5.6.0 before 5.6.1
- Remediation
- Update to 5.6.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- WP Document Revisions on WPSec AttackSurface
- Fix released
- Published
Description
The WP Document Revisions plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 5.6.0 due to the Validate Structure correction REST endpoint (PUT /wpdr/v1/correct/{id}/type/{code}/attach/{parm}, fix codes 6 and 7) only checking that the user can edit document {id}, without verifying that attachment {parm} belongs to that document or that {id} is a document. This makes it possible for authenticated attackers with Contributor-level access and above, who can edit their own documents, to rename, move and delete other media files on the site. Version 5.6.0 shipped without the fix, which 5.4.6 and 5.5.1 already carried; it is fixed in 5.6.1.
References
- https://wpsec.com/vuln/WPSEC-2026-0073/
- https://plugins.svn.wordpress.org/wp-document-revisions/tags/5.6.1/
- https://wordpress.org/plugins/wp-document-revisions/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS