Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-40737 EUVD-2026-22892GHSA-g5jh-99h2-gm4r

WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability

Published Apr 15, 2026 · Updated Apr 29, 2026 · Assigned by Patchstack

Description

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects COMPE: from n/a through <= 1.1.4.

Affected products

VendorProductAffectedFixed
VillaTheme COMPE ≤ 1.1.4 —

References