EUVD-2026-60056
GHSA-qmx7-75c2-8553
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network endpoint with no complexity barrier; impact is read-only PII disclosure per record, so C:L with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.
AnalysisAI
Unauthenticated access to a phone-number lookup endpoint in ShopSmart Loyalty for WooCommerce (versions ≤1.0.0) exposes customer PII - name, email address, and loyalty account balance - to any caller who supplies a valid phone number. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the plugin performs no ownership or identity check before returning profile data. A public exploit exists via WPScan; the SSVC framework flags the attack as automatable, enabling systematic bulk harvesting of customer records across affected WooCommerce stores.
Technical ContextAI
ShopSmart Loyalty for WooCommerce is a WordPress plugin that extends WooCommerce with a customer loyalty points system. The affected CPE is cpe:2.3:a:unknown:shopsmart_loyalty_for_woocommerce:*:*:*:*:*:*:*:* (vendor identifier listed as 'unknown' in NVD, indicating limited vendor attribution). CWE-639 - Authorization Bypass Through User-Controlled Key - describes the root cause: the application uses a user-supplied value (the phone number) as the sole access control key, trusting it without verifying the requestor owns or is authorized to access the associated record. Because phone numbers are semi-public (printed on receipts, business cards, or exposed via prior breaches), this design flaw turns any known phone number into an unauthenticated read credential for the corresponding customer profile.
RemediationAI
The primary remediation is to update the ShopSmart Loyalty for WooCommerce plugin to a version above 1.0.0 if a patched release has been published - no exact fix version is confirmed in available intelligence at time of analysis. Administrators should check the WordPress plugin repository and the WPScan advisory at https://wpscan.com/vulnerability/3b651e19-37f5-468e-8d0b-a82bbe04eaf2/ for current patch status. If no patch is available or the plugin is unmaintained, the recommended compensating control is to deactivate the plugin entirely, which eliminates the exposed endpoint but also disables loyalty program functionality. If deactivation is not acceptable, a WAF rule blocking unauthenticated requests to the phone-number lookup REST endpoint can reduce exposure while preserving authenticated use, though WAF rule precision depends on endpoint path discoverability. Merchants should also audit web server access logs for signs of bulk enumeration (repeated calls to the lookup endpoint with varied phone numbers), as the public PoC makes automated harvesting trivially achievable.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today