WooSquare CVE-2026-110367

Exploitation requires only that the WPExperts APIExperts Square for WooCommerce (WooSquare) plugin version n/a through 4.7.5 be installed and active on an internet-reachable WordPress/WooCommerce store; the flaw stems from an authorization check that is missing on a plugin action, so no login, credentials, or user interaction are needed (PR:N/UI:N) against default configurations. Limiting factors: the integrity-only, low impact (I:L, C:N/A:N) caps what an attacker can achieve to a bounded set of unauthorized operations rather than full compromise, and only sites actually running this specific Square-for-WooCommerce plugin are affected. The input does not name the exact vulnerable endpoint or function, so the precise action an attacker can abuse is not confirmed from available data.

This is a moderate-severity, broken-access-control issue (CWE-862, Missing Authorization) in the WooSquare plugin, rated CVSS 5.3. The vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation requiring no user interaction, which on its face sounds serious. However, the impact is deliberately narrow: C:N/I:L/A:N means no confidentiality or availability loss and only limited integrity impact - an attacker can likely invoke a protected action or modify a limited set of data, not take over the site. No EPSS score, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of a KEV entry and any exploitation signal, combined with the capped Integrity-only impact, suggests this is a real-but-not-urgent issue rather than a high-priority emergency. No SSVC decision data was supplied. Net: patch in normal cadence; it is not a 'critical' despite being unauthenticated, because the technical impact ceiling is low.

An unauthenticated attacker sends a crafted HTTP request directly to a WooSquare plugin endpoint (e.g., an AJAX or REST action) that fails to verify the caller's authorization, performing a protected operation or altering plugin/order data without logging in. Because no user interaction and no authentication are required, the request can be scripted against any reachable store running the vulnerable plugin. No public proof-of-concept was identified in the provided data, so practical exploitation details are unconfirmed.