Mobile App for WooCommerce EUVD-2026-66987

No special conditions are required beyond the target WordPress site having the Mobile App for WooCommerce plugin (version <= 0.4.62) installed and active - the CVSS vector confirms AV:N/AC:L/PR:N/UI:N, meaning exploitation is possible remotely with no authentication, no elevated complexity, and no user interaction. The limiting factors are that the plugin must be installed and active on the target site, and WooCommerce must be present as a dependency. There is no indication that a specific non-default configuration is required; the flaw appears to affect default plugin functionality. Exploitation is constrained to the scope of the vulnerable WordPress/WooCommerce installation (S:U, no scope change to the broader host OS or other systems).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, score 8.6) reflects a network-exploitable, zero-complexity, unauthenticated flaw with high confidentiality impact - a strong signal for urgency. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically; however, the attack profile (no prerequisites, remote, no user interaction) means automated scanning tools could trivially enumerate and exploit vulnerable stores at scale. KEV status is not confirmed, and no public POC has been identified at time of analysis, which somewhat tempers immediate alarm. Despite this, the sheer number of WooCommerce deployments means even a mid-sized online retailer or municipal procurement portal in kalisz running this plugin would be directly exposed to customer data leakage and order manipulation. The low integrity and availability impacts suggest partial write access and possible minor disruption are achievable alongside data exfiltration, but full store takeover is not indicated by available data. Overall, this is a genuine priority for any site running the affected plugin version - the combination of unauthenticated network access and high confidentiality impact outweighs the absence of confirmed in-the-wild exploitation.

An unauthenticated attacker sends crafted HTTP requests to the plugin's exposed REST API or custom WordPress endpoints, bypassing the missing authorization check to retrieve WooCommerce order data, customer PII, or product pricing information. Because no authentication or user interaction is required, an automated scanner or script could enumerate thousands of WooCommerce stores running the vulnerable plugin and harvest data at scale. No public POC has been identified at time of analysis, but the straightforward nature of missing-authorization flaws means exploit development requires minimal effort.