EUVD-2026-66987
GHSA-cjxc-xr6h-493g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Network-accessible endpoint requires no authentication (PR:N), no complexity; high confidentiality loss aligns with order/customer data exposure, limited integrity and availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.
AnalysisAI
Broken access control in the Mobile App for WooCommerce WordPress plugin (versions <= 0.4.62, by Weptile) allows unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data within WooCommerce-powered stores. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requestor has permission before fulfilling sensitive API or endpoint requests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the target WordPress site having the Mobile App for WooCommerce plugin (version <= 0.4.62) installed and active - the CVSS vector confirms AV:N/AC:L/PR:N/UI:N, meaning exploitation is possible remotely with no authentication, no elevated complexity, and no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, score 8.6) reflects a network-exploitable, zero-complexity, unauthenticated flaw with high confidentiality impact - a strong signal for urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update the Mobile App for WooCommerce plugin beyond version 0.4.62 as soon as a patched release is confirmed available via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mobile-app-for-woocommerce/vulnerability/wordpress-mobile-app-for-woocommerce-plugin-0-4-62-broken-access-control-vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete audit of all WooCommerce installations to identify those running Mobile App for WooCommerce (Weptile) version 0.4.62 or earlier, and assess any business-critical dependencies on this plugin. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today