WP Document Revisions <= 5.4.5 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Attachment Rename and Deletion via Validate Structure Fix Endpoint
- ID
- WPSEC-2026-0082
- Plugin
- WP Document Revisions (wp-document-revisions)
- Affected
- from 3.4.0 before 5.4.6
- Remediation
- Update to 5.4.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP Document Revisions on WPSec AttackSurface
- Fix released
- Published
Description
The WP Document Revisions plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.4.5 due to the Validate Structure correction REST endpoint (PUT /wpdr/v1/correct/{id}/type/{code}/attach/{parm}, fix codes 6 and 7) only checking that the user can edit document {id}, without verifying that attachment {parm} belongs to that document or that {id} is a document. This makes it possible for authenticated attackers with Contributor-level access and above, who can edit their own documents, to rename, move and delete other media files on the site. Fixed in 5.4.6 on the 5.4.x branch, and in 5.5.1 and 5.6.1 on the newer branches.
References
- https://wpsec.com/vuln/WPSEC-2026-0082/
- https://plugins.svn.wordpress.org/wp-document-revisions/tags/5.4.6/
- https://wordpress.org/plugins/wp-document-revisions/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS