Description
Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.
Published: 2026-08-13
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthenticated Insecure Direct Object Reference in Do Lasso plugin versions up to 358, allowing attackers to reference or modify protected resources without proper authorization checks. This could lead to the disclosure, alteration, or deletion of user data, compromising confidentiality, integrity, and potentially availability of the affected system. The weakness is classified as CWE-639.

Affected Systems

WordPress plugin Do Lasso provided by Lasso Analytics, Inc., affecting all installations of version 358 or earlier.

Risk and Exploitability

With a CVSS score of 6.5 the vulnerability is deemed medium severity. Exploitation is possible remotely without authentication, and no exploit probability is currently available; the vulnerability is not listed in CISA KEV. An attacker can craft requests containing arbitrary object identifiers to access or modify data beyond their permissions, making mitigation a priority.

Generated by OpenCVE AI on August 13, 2026 at 16:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Do Lasso plugin to the latest available version (≥ 359) to remove the IDOR flaw.
  • Revoke or delete any credentials that might expose old object identifiers before applying the patch.
  • Verify that the plugin update is active and monitor access logs for anomalous requests to object endpoints.

Generated by OpenCVE AI on August 13, 2026 at 16:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Lasso Analytics, Inc.
Lasso Analytics, Inc. do Lasso
Wordpress
Wordpress wordpress
Vendors & Products Lasso Analytics, Inc.
Lasso Analytics, Inc. do Lasso
Wordpress
Wordpress wordpress

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.
Title WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

Lasso Analytics, Inc. Do Lasso
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-13T15:48:34.121Z

Reserved: 2026-02-25T12:14:29.690Z

Link: CVE-2026-28155

cve-icon Vulnrichment

Updated: 2026-08-13T14:30:10.832Z

cve-icon NVD

Status : Deferred

Published: 2026-08-13T14:16:58.197

Modified: 2026-08-14T19:09:20.713

Link: CVE-2026-28155

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T09:32:13Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key