CVE-2025-49334: 
WordPress vulnerability analysis and mitigation

CVE-2025-49334 is an Insecure Direct Object Reference (IDOR) / Authorization Bypass Through User-Controlled Key vulnerability in the MyD Delivery WordPress plugin, developed by Eduardo Villão. It allows unauthenticated network attackers to bypass access controls and read sensitive data by manipulating user-controlled keys. The vulnerability affects all versions of the plugin through 1.9.12 (the affected version range was revised multiple times by Patchstack after initial disclosure). It was reported on October 16, 2025, and publicly disclosed on December 31, 2025, with a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), corresponding to OWASP Top 10 category A1: Broken Access Control. The plugin fails to properly validate or restrict access to object references that are supplied by the user, allowing an unauthenticated attacker to directly reference internal objects (such as delivery records or order data) by manipulating identifiers in HTTP requests. No authentication or special privileges are required, and the attack can be carried out remotely over the network with low complexity (Patchstack).

Successful exploitation results in unauthorized read access to sensitive data managed by the MyD Delivery plugin, such as delivery order details or customer information, constituting a confidentiality breach. There is no impact on integrity or availability. The attack requires no authentication, making it accessible to any remote attacker, though the scope is limited to the plugin's data and does not directly enable lateral movement or system-level compromise (Patchstack, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Patchstack).

1. Reconnaissance: Identify WordPress sites running the MyD Delivery plugin (versions ≤ 1.9.12) using tools like WPScan or by inspecting plugin directories on target sites.
2. Identify object references: Browse the site as an unauthenticated user and observe HTTP requests that include object identifiers (e.g., order IDs, delivery record IDs) in URL parameters or POST body fields.
3. Manipulate object references: Modify the user-controlled key (e.g., increment or enumerate order/delivery IDs) in requests to reference objects belonging to other users or restricted records.
4. Access sensitive data: Submit the crafted requests and observe the server's response, which may return delivery details, customer information, or other sensitive data without enforcing proper authorization checks (Patchstack).

• Network: Unusual HTTP GET or POST requests to MyD Delivery plugin endpoints with sequentially enumerated or out-of-range object IDs (e.g., order or delivery record identifiers) from unauthenticated sessions.
• Logs: WordPress access logs showing repeated requests to plugin-specific endpoints (e.g., /wp-admin/admin-ajax.php or plugin REST API routes) with varying object ID parameters from the same IP address, particularly without authentication cookies.
• Logs: High volume of 200 OK responses to delivery/order lookup endpoints from unauthenticated users, suggesting successful enumeration of records.

As of the latest available information, no official patch has been released by the plugin developer for CVE-2025-49334; the Patchstack advisory notes "No official patch available" for versions through 1.9.12. Site administrators are advised to disable or remove the MyD Delivery plugin until a patched version is available. Patchstack customers receive early warning and virtual patching protection. If removal is not feasible, restricting access to plugin endpoints via web application firewall (WAF) rules or server-level controls can reduce exposure (Patchstack).

The vulnerability was discovered and reported by security researcher "powpy" and disclosed through Patchstack's vulnerability disclosure program on December 31, 2025. Patchstack classifies it as low priority with unlikely exploitation impact. No significant broader media coverage or notable community commentary has been identified beyond standard vulnerability database aggregation (Patchstack).