CVE-2026-66634: WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Q: Which plugin versions are affected?

The affected versions are Modal Survey plugin versions up to and including 2.0.2.2.3.

Q: What level of access does an attacker need?

An attacker needs Subscriber-level privileges to exploit the issue. The CVSS vector indicates it can be exploited remotely with low attack complexity and does not require user interaction.

Q: What is the expected impact if exploited?

Successful exploitation can disclose information, but the provided CVSS assessment does not indicate an integrity or availability impact.

Published Aug 18, 2026

Updated

Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

Affected Software

1 affected component

WordPress Modal Survey plugin<=2.0.2.2.3

Event History

Aug 18, 2026

CVE Published

via MITRE·01:59 PM

Data Sourced

via MITRE·01:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which plugin versions are affected?

The affected versions are Modal Survey plugin versions up to and including 2.0.2.2.3.

What level of access does an attacker need?

An attacker needs Subscriber-level privileges to exploit the issue. The CVSS vector indicates it can be exploited remotely with low attack complexity and does not require user interaction.

What is the expected impact if exploited?