What is the CVSS score of CVE-2026-28169?

CVE-2026-28169 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

YITH WooCommerce Zoom Magnifier CVE-2026-28169

EUVD-2026-53947 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-08-06 Patchstack

GHSA-fm6c-f7f6-qg3c

WordPress Information Disclosure Wordpress Plugin Yith Woocommerce Zoom Magnifier Yithemes

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible endpoint with no auth required (PR:N, AV:N); only limited confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:59 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

MEDIUM 5.3

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the YITH WooCommerce Zoom Magnifier WordPress plugin (versions ≤ 2.52.0) permits remote, unauthenticated attackers to retrieve sensitive information without any credentials. Classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the plugin exposes data through a network-accessible endpoint that lacks proper authorization controls. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity makes opportunistic discovery straightforward.

Technical ContextAI

YITH WooCommerce Zoom Magnifier is a WordPress plugin developed by YITH (yithemes) that provides product image zoom functionality for WooCommerce storefronts. The affected component is identified by CPE cpe:2.3:a:yithemes:yith_woocommerce_zoom_magnifier:*:*:*:*:*:*:*:* across all versions up to and including 2.52.0. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) indicates the root cause is an endpoint or AJAX handler that returns internal application data - such as configuration values, file paths, API keys, or system metadata - without verifying that the requester is authenticated or authorized. This is a common plugin vulnerability pattern in the WordPress/WooCommerce ecosystem where REST API or admin-ajax.php handlers omit capability checks.

RemediationAI

The primary remediation is to update the YITH WooCommerce Zoom Magnifier plugin to the version immediately above 2.52.0. The exact patched release version was not confirmed in the available data - consult the WordPress plugin repository or the YITH official site to identify the current release and verify it addresses this CVE. The Patchstack advisory at the reference URL should be monitored for an explicit fixed version number. If an immediate upgrade is not possible, a compensating control is to restrict access to the WordPress admin-ajax.php endpoint and any REST API routes registered by the plugin using a web application firewall (WAF) rule or server-level IP allowlist; the trade-off is potential disruption to legitimate frontend zoom functionality. Disabling the plugin entirely until patched is the safest workaround if zoom functionality is non-critical.