WordPress Plugin Vulnerabilities

ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone

Description

The plugin does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.

Proof of Concept

Affects Plugins

Plugin icon
shopsmart-loyalty-for-woocommerce
No known fix

References

CVE
CVE-2026-14832

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
3b651e19-37f5-468e-8d0b-a82bbe04eaf2

Timeline

Publicly Published
2026-08-14 (about 2 days ago)
Added
2026-08-07 (about 9 days ago)
Last Updated
2026-08-07 (about 9 days ago)

Other

Published
Title
Published
2025-03-31
Title
WPCargo Track & Trace <= 8.0.2 - Contributor+ Insecure Direct Object Reference
Published
2024-08-16
Title
wpForo Forum < 2.3.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-08-15
Title
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin < 1.6.12.11 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference via 'quantity'
Published
2025-04-11
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.1.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update