WordPress Plugin Vulnerabilities

Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure

Description

The plugin does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.

Proof of Concept

Affects Plugins

Plugin icon
easy-sale-badges-for-woocommerce
Fixed in 7.5.2

References

CVE
CVE-2026-88929

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Que Thanh Tuan
Submitter
Que Thanh Tuan
Verified
Yes
WPVDB ID
d6e10041-4171-4153-94bc-e8936be779c1

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2024-09-06
Title
Big File Uploads < 2.1.3 - Authenticated (Author+) Full Path Disclosure
Published
2024-12-17
Title
Animation Addons for Elementor < 1.1.7 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template
Published
2025-11-09
Title
WooCommerce Ultimate Points And Rewards < 2.10.3 - Authenticated (Subscriber+) Information Exposure
Published
2025-11-26
Title
ERP < 1.16.7 - Authenticated (Subscriber+) Information Exposure
Published
2025-11-26
Title
Quick View for WooCommerce < 2.2.18 - Unauthenticated Private Product Disclosure