What is GHSA-3fmm-mc8g-m4mq?

GHSA-3fmm-mc8g-m4mq is a security advisory published by GitHub Security Advisories with Medium severity. The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the...

Which CVE IDs does GHSA-3fmm-mc8g-m4mq cover?

GHSA-3fmm-mc8g-m4mq covers the following CVE IDs: CVE-2026-124652. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3fmm-mc8g-m4mq?

GHSA-3fmm-mc8g-m4mq has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-3fmm-mc8g-m4mqMediumCVSS 4.3

The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the...

Vendor

GitHub Security Advisories

Published

November 12, 2026

Last Modified

November 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-124652 →

📋 Description

The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment status, allowing any authenticated user, such as subscriber, to read other customers' order status, the purchased item and, while an Alipay payment is in progress, the buyer's Alipay account identifier.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-124652
https://wpscan.com/vulnerability/ed4ce4b8-a30b-443c-9b5a-b7415e30eb62
https://github.com/advisories/GHSA-3fmm-mc8g-m4mq