EUVD-2026-48249
GHSA-qj6p-9g9v-5h6g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible endpoint requires only low-privilege WordPress authentication; high confidentiality impact from system data exposure; no integrity or availability impact applies.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
Lifecycle Timeline
2DescriptionCVE.org
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data.
This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.
AnalysisAI
Sensitive system information disclosure in the MultiVendorX WooCommerce Product Stock Alert WordPress plugin (versions through 3.0.6) allows low-privileged authenticated users to retrieve embedded sensitive data via a network-accessible endpoint. The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) confirms that any authenticated WordPress user - such as a registered shop customer - can exploit this with low complexity and no user interaction, yielding high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible nature of the flaw lowers the bar for abuse significantly.
Technical ContextAI
CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes a class of flaws where internal system details - such as server paths, database credentials, configuration values, or internal API keys - are returned in application responses accessible to users who should not receive them. In the WordPress/WooCommerce ecosystem, this commonly manifests as a REST API endpoint, AJAX handler, or shortcode response that fails to restrict output to privileged roles. The WooCommerce Product Stock Alert plugin by MultiVendorX provides back-in-stock notification functionality for WooCommerce stores; its internal processing of subscriber data or stock-check routines appears to expose system-level information through an insufficiently guarded response path. The CVSS PR:L rating indicates the flaw is reachable by any authenticated WordPress user, consistent with subscriber-tier or customer-tier REST or AJAX routes that lack proper capability checks.
RemediationAI
Update the WooCommerce Product Stock Alert plugin to a version beyond 3.0.6 as soon as a patched release is confirmed available in the WordPress plugin repository or via the vendor. The exact fix version is not independently confirmed from available data - verify the current release in the WordPress.org plugin directory or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-product-stock-alert/vulnerability/wordpress-woocommerce-product-stock-alert-plugin-3-0-6-sensitive-data-exposure-vulnerability?_s_id=cve before upgrading. If no patch is yet available, compensating controls include: deactivating the plugin entirely until a fix ships (this disables stock alert subscription functionality for customers); restricting WordPress user registration to prevent unknown parties from obtaining the low-privilege credentials required for exploitation; and using a web application firewall rule to block unexpected REST API or admin-ajax requests targeting this plugin's endpoints. Note that restricting registration may impact legitimate customer workflows on marketplace sites.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today