Skip to content
Fencer Intel
no cvss —

CVE-2026-124652 json

Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR

published 3h ago modified 3h ago also EUVD-2026-124283

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment status, allowing any authenticated user, such as subscriber, to read other customers' order status, the purchased item and, while an Alipay payment is in progress, the buyer's Alipay account identifier.

Patch / fix

  • Unknown Mine CloudVod 2.6.6

Is CVE-2026-124652 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploits and checks

  • wpscan.com https://wpscan.com/vulnerability/ed4ce4b8-a30b-443c-9b5a-b7415e30eb62/ referenced PoC, tagged "exploit" by a source, unverified

Affected products

  • Unknown Mine CloudVod

Classification

Weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.