CVE-2026-8611
Insecure Direct Object Reference in Klamra Paycal for Aspaclaria Plugin
Publication date: 2026-06-06
Last updated on: 2026-06-06
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| klamra | paycal | to 1.1.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Klamra Paycal for Aspaclaria plugin for WordPress has an Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 1.1.4. This vulnerability arises because the 'invoice_id' parameter lacks proper validation, allowing authenticated users with subscriber-level access or higher to manipulate this parameter.
By exploiting this flaw, attackers can enumerate sequential post IDs to download arbitrary customer invoices that do not belong to them.
This exposes sensitive billing personally identifiable information (PII) such as full names, email addresses, phone numbers, order totals, line items, and customer notes of other customers.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive customer billing information.
- Attackers with subscriber-level access can access invoices of other customers.
- Exposed data includes full names, email addresses, phone numbers, order totals, line items, and customer notes.
Such exposure can result in privacy violations, loss of customer trust, and potential legal consequences.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers to access sensitive billing personally identifiable information (PII) of other customers, including full name, email address, phone number, order total, line items, and customer notes.
Exposure of such sensitive PII can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require strict controls over access to personal and sensitive information.
Therefore, this vulnerability potentially compromises compliance with these standards by enabling unauthorized disclosure of protected customer data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the 'invoice_id' parameter in the Klamra Paycal for Aspaclaria WordPress plugin, which allows authenticated users with subscriber-level access or higher to download arbitrary customer invoices by enumerating sequential post IDs.
To detect this vulnerability on your system, you can attempt to access invoice data by manipulating the 'invoice_id' parameter in requests to the plugin's invoice download functionality while authenticated as a subscriber or similar role.
Suggested commands or steps include:
- Authenticate as a subscriber-level user on the WordPress site.
- Use a tool like curl or a browser to send HTTP requests to the invoice download endpoint, changing the 'invoice_id' parameter to sequential values.
- Example curl command: curl -b cookies.txt "https://example.com/path/to/invoice/download?invoice_id=123"
- Observe if invoice data for other customers is accessible by incrementing or decrementing the 'invoice_id' value.
If you can access invoices that do not belong to your user, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Restrict access to the invoice download functionality to only trusted user roles until a patch is applied.
- Disable or remove the Klamra Paycal for Aspaclaria plugin if it is not essential.
- Monitor and audit access logs for suspicious activity involving the 'invoice_id' parameter.
- Apply any available updates or patches from the plugin developer as soon as they are released.
Since the vulnerability is due to missing validation on a user-controlled key, ensuring proper access controls and validation on the server side is critical.