wiseCampaign CVE-2026-7529

The wiseCampaign - WooCommerce Conversions Made Easy plugin must be installed and active on a WordPress site; no non-default configuration is required beyond this. The WordPress REST API must be reachable by the attacker, which is the default state for any publicly accessible WordPress installation. Per the CVSS vector (PR:N/UI:N/AC:L), exploitation requires no authentication, no user interaction, and no elevated complexity - any attacker with HTTP access to the WordPress REST API endpoint (/wp-json/) can exploit this. Exploitation is limited to sites running wiseCampaign versions 1.1.16 and below; sites that have disabled the WordPress REST API globally would not be exposed, though this is a non-default and operationally disruptive configuration.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects the unauthenticated network vector and high integrity impact. However, the CVSS confidentiality component is rated N despite the CVE description explicitly stating 'unauthorized modification and disclosure of data' - this inconsistency is not resolved by the available data and the true confidentiality impact may be underrepresented in the published score. No EPSS score was provided in the input; given the niche deployment footprint, real-world exploitation probability is expected to be limited to opportunistic WordPress scanners rather than targeted campaigns. There is no KEV listing and no known public exploit code, which tempers urgency compared to the raw CVSS figure. The attack complexity is genuinely low: any attacker who can reach the WordPress REST API (accessible by default at /wp-json/) can exploit this without credentials or preparation. The file-upload path via wp_handle_upload() is the highest-severity sub-component, as it could be leveraged for content injection or, depending on server configuration and WordPress upload restrictions, potentially more serious abuse.

An unauthenticated attacker enumerates REST API endpoints exposed by the wiseCampaign plugin (discoverable via /wp-json/ route discovery) and sends crafted HTTP POST requests to overwrite banner content with malicious HTML or to upload a custom background image file, defacing the WooCommerce storefront. The same endpoint access allows toggling feature flags and changing the active banner, enabling persistent manipulation of the site's conversion-focused UI elements without any credentials. No public exploit code is required; the absence of any authorization check means standard HTTP clients suffice.