WordPress Plugin Vulnerabilities

Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure

Description

The plugin does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.

Proof of Concept

Affects Plugins

Plugin icon
woo-epos-now-integration
Fixed in 4.11.2

References

CVE
CVE-2026-103323

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Raphael P. Cigana
Submitter
Raphael P. Cigana
Verified
Yes
WPVDB ID
f1859c64-e1d1-4efc-9f34-15d1f4aa3311

Timeline

Publicly Published
2026-10-05 (about 2 days ago)
Added
2026-10-05 (about 1 day ago)
Last Updated
2026-10-05 (about 1 day ago)

Other

Published
Title
Published
2024-07-23
Title
Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells < 3.4.7 - Missing Authorization to Authenticated (Contributor+) Settings Update
Published
2024-12-18
Title
Instantio < 3.3.8 - Missing Authorization to Unauthenticated Settings Update
Published
2023-10-27
Title
myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads Deletion
Published
2024-07-17
Title
Booking Ultra Pro < 1.1.14 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates
Published
2024-10-24
Title
UPS Live Rates and Access Points < 3.0.0 - Missing Authorization to Plugin API key reset