Unauthenticated IDOR in Do Lasso <= 358

Executive Summary

CVE-2026-28155 is an Insecure Direct Object References (IDOR) vulnerability in the WordPress Do Lasso Plugin versions 358 and below. It allows unauthenticated attackers to bypass authorization and access sensitive files, folders, or database interactions without proper permissions.

Useful 0 Not Useful 0

Detection Guidance

Detecting this IDOR vulnerability requires checking if the Do Lasso plugin version 358 or below is installed. Inspect WordPress installations for the plugin and verify its version. No specific commands are provided in the context, but monitoring for unauthorized access attempts or unusual file/folder access patterns may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data, potential data breaches, and manipulation of database interactions. Attackers could exploit it in mass campaigns targeting websites regardless of size or popularity.

Useful 0 Not Useful 0

Compliance Impact

This IDOR vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized access risks exposing personal or protected health data, potentially resulting in legal penalties or breaches of regulatory standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply Patchstack's temporary mitigation rule to block attacks. Avoid using the vulnerable plugin versions until an official patch is released. Consider updating the plugin or contacting hosting providers for assistance. Monitor for suspicious activity and restrict access to sensitive files.

Useful 0 Not Useful 0