PT-2026-26855 · WordPress · Rest Api To Miniprogram

Ronnachai Chaipha

·

Published

2026-03-21

·

Updated

2026-03-21

·

CVE-2026-3460

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions REST API TO MiniProgram plugin for WordPress versions through 5.1.2
Description The REST API TO MiniProgram plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. The issue stems from insufficient validation within the permission callback (update user wechatshop info permissions check), which only confirms the existence of a WordPress user corresponding to the supplied openid parameter. However, the update user wechatshop info function utilizes a separate userid parameter, controlled by the attacker, to modify user metadata without verifying if the openid and userid relate to the same user. This allows authenticated attackers with Subscriber-level access or higher to alter store-related metadata (storeinfo, storeappid, storename) of arbitrary users through the userid parameter in the REST API. The vulnerable API endpoint is not explicitly mentioned. The vulnerable parameters are openid and userid.
Recommendations Versions prior to and including 5.1.2 should be updated.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-3460

Affected Products

Rest Api To Miniprogram