WordPress Plugin Vulnerabilities

ShopApper <= 0.4.66 - Subscriber+ Arbitrary Product Stock Update

Description

The plugin does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock quantity of arbitrary products.

Proof of Concept

Affects Plugins

Plugin icon
mobile-app-for-woocommerce
No known fix

References

CVE
CVE-2026-16569

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
TruongLV1 From FPT Night Wolf
Submitter
TruongLV1 From FPT Night Wolf
Verified
Yes
WPVDB ID
0d96cc80-0bba-45e4-8e07-220dc8b82c7d

Timeline

Publicly Published
2026-08-25 (about 2 days ago)
Added
2026-08-18 (about 8 days ago)
Last Updated
2026-08-25 (about 1 day ago)

Other

Published
Title
Published
2026-08-10
Title
TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up
Published
2021-10-26
Title
Bulk Datetime Change < 1.12 - Missing Authorisation
Published
2024-06-03
Title
WP-DB-Table-Editor <= 1.8.4 - Missing Authorization to Authenticated(Contributor+) Database Access
Published
2022-01-03
Title
TrustMate.io integration for WooCommerce < 1.7.1 - Subscriber+ Arbitrary Blog Option Update
Published
2021-11-15
Title
User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata Access