Description

Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-11T19:17:44.750Z",
  "pubdate": "2026-09-11T19:17:44.750Z",
  "executiveSummary": "The Starter Templates plugin for WordPress, in versions <= 4.7.5, is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. This security flaw stems from insufficient authorization checks when processing requests related to template operations. An attacker with a Contributor-level account, or higher, can manipulate request parameters to interact with or modify objects they are not authorized to access. This vulnerability allows for unauthorized data manipulation or administrative actions, compromising the integrity of the plugin's configuration and template management. The risk is significant because it allows low-privileged users to perform actions restricted to administrators, potentially leading to unauthorized site modifications or data leakage. Exploitation requires authenticated access to the target WordPress instance, specifically a user account with the Contributor capability or higher. No external network exposure is required as the attack originates from within the application's authenticated session interface.",
  "technicalDetails": "The vulnerability manifests due to a failure in the Starter Templates plugin to perform server-side authorization checks on inputs that reference specific object IDs. The core issue lies within the plugin's REST API endpoints or AJAX handlers, which fail to validate whether the authenticated user possesses the appropriate permissions to manipulate the specific resource identified in the request payload or URL parameters.\nSpecifically, the application logic assumes that a user authorized to perform general plugin operations is also authorized to access or modify any object index, regardless of whether that object is globally defined or user-specific. By intercepting HTTP requests directed at the plugin's management interface, an attacker can modify identifiers—such as post IDs, template IDs, or configuration indices—to reference unauthorized resources.\nThe attack flow proceeds as follows: First, the attacker authenticates as a user with the Contributor role. Second, the attacker interacts with the plugin's UI while monitoring the network traffic using a proxy tool (e.g., Burp Suite). Third, the attacker identifies a request containing a parameter that specifies an object ID. Fourth, the attacker modifies this ID to a target value belonging to a different object or a protected administrative configuration. Finally, the server processes the request, lacking the necessary capability check (e.g., current_user_can('manage_options')), and performs the action (such as modification or deletion) on the target object despite the attacker's limited privilege level.\nBecause the plugin does not verify the ownership or accessibility of the requested object ID before executing the back-end operation, the application effectively grants a user unauthorized access to protected data structures. This IDOR vulnerability bypasses the intended role-based access control (RBAC) model implemented in the WordPress ecosystem. The impact of successful exploitation includes, but is not limited to, the unauthorized modification of template settings, potential exposure of sensitive configuration metadata, or the disruption of service by altering plugin-specific data entries that might influence site appearance or performance."
}