CVE-2026-124652mediumCWE-639

CVE-2026-124652: medium-severity vulnerability in Mine CloudVod

Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR

Published

Follow this CVE+ Monitor Mine CloudVod

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.3epss 0.1%
The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment status, allowing any authenticated user, such as subscriber, to read other customers' order status, the purchased item and, while an Alipay payment is in progress, the buyer's Alipay account identifier.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Mine CloudVod
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Mine CloudVod

In the same product, most dangerous first.

CVE-2026-124653MEDIUMMine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential DisclosureEPSS 0.1%CVE-2026-124664MEDIUMMine CloudVod < 2.6.7 - Unauthenticated Paid Lesson Content DisclosureEPSS —