ShinyStat Analytics < 1.0.17 – Unauthenticated Non-Published Product Information Disclosure | CVE 2026-11351

Description

The plugin does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.

Proof of Concept

ShinyStat Analytics <= 1.0.16 - Unauthenticated Non-Published Product Information Disclosure

Prerequisites:
- WooCommerce is active (the endpoint returns a "wc_not_found" error otherwise).
- At least one non-published product exists (draft / pending / private). Product IDs are sequential WordPress post IDs, so an unauthenticated attacker can simply enumerate them.

The REST route shinystat/v1/product/<id> is registered with permission_callback set to __return_true, and its handler resolves the product with wc_get_product() without checking the post status. Non-published products are therefore returned to anonymous users.

Steps (no authentication, no nonce):

# Retrieve a draft product (id 9 in this example):
curl -s "https://victim.example/wp-json/shinystat/v1/product/9"

Expected result: HTTP 200 with the product details of the draft, for example:
{"id":9,"product_title":"SECRET Unreleased Gadget X9","product_type":"Confidential unreleased description...","handle":"","url":"https://victim.example/?post_type=product&p=9","image":"","categories":[],"price":79999,"compare_at_price":99999,"options_with_values":[]}

The response leaks the product title, description, slug, permalink, image URL, category names and pricing (price = current price x100, compare_at_price = regular price x100) of products that have not been published.

Control: requesting the same draft via WordPress core's REST API returns HTTP 401 ("rest_forbidden"), confirming this information is not meant to be available to unauthenticated users.