WordPress Plugin Vulnerabilities

ShopApper <= 0.4.69 - Subscriber+ Customer Data Disclosure via IDOR

Description

The plugin does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.

Proof of Concept

Affects Plugins

Plugin icon
mobile-app-for-woocommerce
No known fix

References

CVE
CVE-2026-16568

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
TruongLV1 From FPT Night Wolf
Submitter
TruongLV1 From FPT Night Wolf
Verified
Yes
WPVDB ID
489be79d-df68-4384-83ab-c3fa5400eadc

Timeline

Publicly Published
2026-08-25 (about 3 days ago)
Added
2026-08-18 (about 9 days ago)
Last Updated
2026-08-28 (about 4 hours ago)

Other

Published
Title
Published
2025-09-09
Title
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Published
2026-04-20
Title
EventPrime – Events Calendar, Bookings and Tickets < 4.3.0.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2023-01-27
Title
Quick Restaurant Menu < 2.1.0 - Subscriber+ Arbitrary Post Deletion/Updating
Published
2026-07-01
Title
My Calendar < 3.7.15 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter
Published
2026-06-06
Title
ProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR