CVE-2024-32823 MEDIUM

CVE-2024-32823: WordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerability

Vendor Feedbackwp
Product Rate my Post – WP Rating System
Weakness CWE-639 · IDOR
Published April 24, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in FeedbackWP Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.4.

Explanation of Vulnerability in Simple Terms

02Summary

The Rate my Post plugin for WordPress contains an authorization flaw that allows unauthenticated attackers to modify rating data through the plugin's API endpoints. The vulnerability affects versions up to 3.4.4 and requires no user interaction. Site administrators should update to a version newer than 3.4.4 to prevent unauthorized manipulation of post ratings.

What an attacker can do

03Attacker Capabilities

Modify post ratings without authentication or permission.

Potential impact on your site

04Site Impact

Post ratings can be altered by anyone, compromising the integrity of user feedback and review systems.

Conditions required to exploit

05Prerequisites

Network access to the WordPress site; no authentication required.

Key dates

06Disclosure timeline

April 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-12400 FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints CVE-2023-40200 WordPress WP Logo Showcase Responsive Slider and Carousel plugin <= 3.6 - Broken Access Control vulnerability CVE-2026-12418 User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter CVE-2026-48868 WordPress Simple Shopping Cart plugin <= 5.2.9 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-7651 User Registration & Membership <= 5.1.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter