WordPress Plugin Vulnerabilities

Chargely Free Subscriptions <= 1.0 - Unauthenticated WooCommerce REST API Credential Disclosure

Description

The plugin does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store.

Proof of Concept

Affects Plugins

Plugin icon
chargely-free-subscriptions-for-woocommerce
No known fix

References

CVE
CVE-2026-116528

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
9.1 (critical)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
423af746-a5a6-4eb5-a4ac-dcd0396882d4

Timeline

Publicly Published
2026-11-12 (about 2 days ago)
Added
2026-11-12 (about 1 day ago)
Last Updated
2026-11-13 (about 7 hours ago)

Other

Published
Title
Published
2024-04-22
Title
StreamWeasels Twitch Integration < 1.8.0 - Unauthenticated Sensitive Information Exposure
Published
2026-06-10
Title
Product Configurator for WooCommerce < 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc_get_data
Published
2026-03-23
Title
DirectoryPress < 3.6.27 - Unauthenticated Information Exposure
Published
2026-01-08
Title
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot < 2.1.16 - Unauthenticated Sensitive Information Exposure
Published
2025-08-01
Title
BitFire < 4.6 - Unauthenticated Information Exposure