EUVD-2026-50113
GHSA-43wf-wg52-qh5w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible REST endpoint, no credentials needed (PR:N), leaks only read-only non-published product metadata (C:L), with zero integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.
AnalysisAI
Unauthenticated information disclosure in the ShinyStat Analytics WordPress plugin (versions before 1.0.17) exposes non-published WooCommerce product data - including draft, pending, and private listings - via an unprotected REST API endpoint that performs no authorization check. Any internet-accessible WordPress/WooCommerce site running an affected version is vulnerable without credentials or user interaction, consistent with the AV:N/AC:L/PR:N/UI:N CVSS vector. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Technical ContextAI
The ShinyStat Analytics WordPress plugin (CPE: cpe:2.3:a:unknown:shinystat_analytics:*:*:*:*:*:*:*:*) registers a WordPress REST API endpoint that omits or bypasses the required permission_callback authorization gate before returning WooCommerce product objects. This maps directly to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the plugin performs the query and returns results without verifying whether the requesting user holds any capability (e.g., read_private_products). WordPress REST API best practice mandates that endpoints serving non-public data enforce capability checks; when absent, any HTTP client - authenticated or not - can retrieve data WordPress otherwise restricts to privileged users. The leaked data includes WooCommerce product metadata in non-public states (draft, pending, private), which store operators treat as confidential - encompassing unreleased product lines, pricing strategies, and internal content.
RemediationAI
Update the ShinyStat Analytics WordPress plugin to version 1.0.17 or later, which is the vendor-released patch that introduces the missing authorization check on the affected REST API endpoint; updates are available through the WordPress plugin dashboard or repository. As an immediate temporary workaround prior to patching, deactivating the ShinyStat Analytics plugin eliminates the vulnerable endpoint entirely with the trade-off of losing analytics tracking. A Web Application Firewall rule blocking unauthenticated requests to the specific plugin REST API route (identifiable from the WPScan advisory at https://wpscan.com/vulnerability/cac3a0c4-e6b9-42a6-b702-abcba67038c2/) can serve as an intermediate control, though the exact endpoint path must be sourced from the plugin source or WPScan disclosure. Restricting REST API access at the network perimeter to authenticated sessions only is another option but may break legitimate integrations. See the WPScan advisory and NVD entry for authoritative remediation guidance.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today