WordPress Plugin Vulnerabilities

PrintAura WooCommerce API <= 4.0.2 - Unauthenticated WooCommerce REST API Authentication Bypass

Description

The plugin does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks.

Proof of Concept

Affects Plugins

References

Classification

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-10 (about 7 hours ago)

Other