Shinystat Analytics
Monthly
Unauthenticated information disclosure in the ShinyStat Analytics WordPress plugin (versions before 1.0.17) exposes non-published WooCommerce product data - including draft, pending, and private listings - via an unprotected REST API endpoint that performs no authorization check. Any internet-accessible WordPress/WooCommerce site running an affected version is vulnerable without credentials or user interaction, consistent with the AV:N/AC:L/PR:N/UI:N CVSS vector. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Unauthenticated information disclosure in the ShinyStat Analytics WordPress plugin (versions before 1.0.17) exposes non-published WooCommerce product data - including draft, pending, and private listings - via an unprotected REST API endpoint that performs no authorization check. Any internet-accessible WordPress/WooCommerce site running an affected version is vulnerable without credentials or user interaction, consistent with the AV:N/AC:L/PR:N/UI:N CVSS vector. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.