CVE-2026-16568
ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR
- State
- Published
- Severity
- 4.3 Medium
- Published
- Aug 27, 2026
- Updated
- Aug 27, 2026
- Reserved
- Jul 22, 2026
Description
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerceUnknown |
|
References
- https://wpscan.com/vulnerability/489be79d-df68-4384-83ab-c3fa5400eadc/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.