CVE-2025-49334

WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability

View on CVE.org
Published Dec 31, 2025 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.7.1.

Analysis

AI-generated

Technical impact

The vulnerability allows a user to bypass authorization controls by using a controllable key, leading to an insecure direct object reference. An attacker could gain access to or modify objects that should be restricted, potentially exposing sensitive data or altering configuration settings. This is a classic IDOR flaw identified as CWE-639.

Affected Systems

The MyD Delivery plugin by Eduardo Villão for WordPress, versions n/a through 1.7.1, are affected. Any WordPress site using these plugin versions is at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is through the web interface of the plugin, where an attacker can supply a user-controlled key. Exploitation may require authenticated access or could be possible as an unauthenticated user depending on the plugin's access control settings.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the MyD Delivery plugin to a version newer than 1.7.1.
  • If an upgrade is not immediately possible, disable or remove the plugin from the WordPress installation to prevent exploitation.
  • Review and enforce strict access controls for plugin configuration pages and data objects to ensure that only authorized roles can view or modify them.

Generated by OpenCVE AI on April 30, 2026 at 04:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.9. Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.7.1.
Title WordPress MyD Delivery plugin <= 1.9 - Insecure Direct Object References (IDOR) vulnerability WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability
Type Values Removed Values Added
Description Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.7.1. Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.9.
Title WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability WordPress MyD Delivery plugin <= 1.9 - Insecure Direct Object References (IDOR) vulnerability
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Type Values Removed Values Added
Description Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through 1.3.7. Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.7.1.
Title WordPress MyD Delivery plugin <= 1.3.7 - Insecure Direct Object References (IDOR) vulnerability WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through 1.3.7.
Title WordPress MyD Delivery plugin <= 1.3.7 - Insecure Direct Object References (IDOR) vulnerability
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Earlier changes (3)
Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:13 PM
Reserved
Jun 4, 2025, 9:42 AM

View source JSON

Updated
Dec 31, 2025, 4:51 PM

JSON

Status
Deferred
Published
Dec 31, 2025, 4:15 PM
Modified
Jun 17, 2026, 9:31 AM

View source JSON

No data.

Updated
Apr 30, 2026, 4:45 AM

JSON