CVE-2026-106603: WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress HollerBox pluginto a version that resolves this vulnerability.Fixed in 2.3.15
Event History
Frequently Asked Questions
Which deployments are affected?
Groundhogg HollerBox versions through 2.3.14 are affected. The available data does not identify an unaffected fixed version.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What security impact can exploitation have?
The listed impact is low integrity and low availability impact, with no confidentiality impact. The issue is described as an authorization bypass through a user-controlled key and incorrectly configured access-control levels.