CVE-2025-13004 MEDIUM

CVE-2025-13004: IDOR in Farktor Software's E-Commerce Package

Vendor Farktor Software E-Commerce Services Inc.
Product E-Commerce Package
Weakness CWE-639 · IDOR
Published February 12, 2026
Last update June 4, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Manipulating User-Controlled Variables. This issue affects E-Commerce Package: through 27112025.

Key dates

02Disclosure timeline

February 12, 2026 CVE published
June 4, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-3287 A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0 CVE-2026-32533 WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability CVE-2023-0688 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode CVE-2018-25129 SOCA Access Control System 180612 Information Disclosure via Multiple Endpoints CVE-2024-4279 Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion