---
id: "CVE-2026-124652"
page: "https://infrastack.ai/live/CVE-2026-124652"
kind: "vulnerability"
aliases: ["CVE-2026-124652"]
title: "WordPress CloudVod plugin lets any logged-in user read others' orders"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cloudvod", "runtime", "self-hosted", "wordpress"]
not_affected_if: ["no-user-registration", "not-installed", "plugin-at-2.6.6-or-later"]
published_at: "2026-11-12T06:17:13+00:00"
first_seen_at: "2026-11-12T06:36:53+00:00"
updated_at: "2026-11-12T06:37:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124652", "first_seen_at": "2026-11-12T06:36:53+00:00"}]
exploit_sources: []
---

# WordPress CloudVod plugin lets any logged-in user read others' orders

Link for people: https://infrastack.ai/live/CVE-2026-124652 (this .md is for agents)

The Mine CloudVod WordPress plugin before 2.6.6 does not check that an order belongs to the requesting user before returning its payment status. Any logged-in user, including a basic subscriber, can read other customers' order status, purchased items and, during an Alipay payment, the buyer's Alipay account identifier.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CloudVod plugin version in the WordPress admin under Plugins; affected if it is below `2.6.6`.

## Fix

- Mine CloudVod WordPress plugin: move to `2.6.6` or later.

## Timeline

- 2026-11-12T06:36:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124652

## From the sources

The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment status, allowing any authenticated user, such as subscriber, to read other customers' order status, the purchased item and, while an Alipay payment is in progress, the buyer's Alipay account identifier.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_