CVE-2026-103323
Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure
- State
- Published
- Severity
- 5.9 Medium
- Published
- Oct 7, 2026
- Updated
- Oct 7, 2026
- Reserved
- Sep 30, 2026
Description
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Integration for Epos Now and WooCommerceUnknown |
|
References
- https://wpscan.com/vulnerability/f1859c64-e1d1-4efc-9f34-15d1f4aa3311/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.