Shopsmart Loyalty For Woocommerce
Monthly
Unauthenticated access to a phone-number lookup endpoint in ShopSmart Loyalty for WooCommerce (versions ≤1.0.0) exposes customer PII - name, email address, and loyalty account balance - to any caller who supplies a valid phone number. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the plugin performs no ownership or identity check before returning profile data. A public exploit exists via WPScan; the SSVC framework flags the attack as automatable, enabling systematic bulk harvesting of customer records across affected WooCommerce stores.
Unauthenticated access to a phone-number lookup endpoint in ShopSmart Loyalty for WooCommerce (versions ≤1.0.0) exposes customer PII - name, email address, and loyalty account balance - to any caller who supplies a valid phone number. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the plugin performs no ownership or identity check before returning profile data. A public exploit exists via WPScan; the SSVC framework flags the attack as automatable, enabling systematic bulk harvesting of customer records across affected WooCommerce stores.