ShopMagic for WooCommerce CVE-2025-59578

The flaw is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data) in a WordPress plugin distributed through the WordPress.org/WooCommerce ecosystem. ShopMagic is an automation and email-marketing extension for WooCommerce stores; by design it assembles data from orders, customers, and store configuration and transmits it through outbound channels such as notification emails, templated messages, and rendered plugin output. CWE-201 occurs when a product deliberately sends data to another actor but inadvertently includes sensitive fields (credentials, tokens, personal data, or internal store details) in that payload, so the disclosure happens at the point of transmission or rendering rather than through a classic access-control bypass. Because the CVSS vector carries PR:N/UI:N, the leaking path is reachable without prior authentication or victim interaction and appears exercisable under default plugin operation, although the advisory does not identify the specific endpoint, parameter, or template that exposes the data, so the exact trigger remains unconfirmed from available data. The divergence between Patchstack's Scope:Changed rating (which treats the leak as crossing from the plugin into the wider WordPress/WooCommerce trust boundary and yields 5.8) and our Scope:Unchanged rating (5.3) is the only substantive scoring disagreement; both assessments agree on network vector, low attack complexity, no privileges, no interaction, and low confidentiality-only impact. No CPE string was supplied, so affected-instance fingerprinting must be done by enumerating installed WordPress plugins and their versions rather than by CPE matching.