CVE-2026-62134
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Starter Templates plugin in versions up to and including 4.7.5 contains an Insecure Direct Object References (IDOR) vulnerability. A user with the Contributor role can access objects they should not have permission to.
Risk Assessment
A low-privileged user (Contributor) may read or modify data belonging to other users, potentially leading to information disclosure or unauthorized changes on the site.
Recommendation
Update the Starter Templates plugin to a version newer than 4.7.5 once a fix is available, and consider temporarily limiting Contributor-role accounts.
Other vulnerabilities in Starter Templates
See all- CVE-2026-39721Medium
A Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Starter Templates from n/a through 4.7.7.
- CVE-2026-102393Medium
The Starter Templates plugin (astra-sites) up to version 4.7.7 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.
Original NVD description (English source)
Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS