Security Alert Summary
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce plugin (versions up to and including 0.4.62) does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints. This allows any authenticated user, such as a customer or subscriber, to retrieve other users’ personal data including email addresses, names, and roles.
CVE Details
- CVE ID: CVE-2026-16568
- Affected component: Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce plugin
- Affected versions: Versions up to and including 0.4.62
- Published: August 27, 2026 at 6:16:56 AM UTC
- Last modified: August 27, 2026 at 6:16:56 AM UTC
- CVSS v3.1: Not provided in the CVE data
- Authentication / privileges / user interaction:
- Authentication required: Yes – an authenticated user (for example, a customer or subscriber)
- Privileges required: No elevated privileges; any authenticated user role can trigger the issue
- User interaction: No additional interaction beyond authentication is required
- Primary impact:
- Confidentiality: Disclosure of personal data including email addresses, names, and user roles
- Integrity: No integrity impact indicated
- Availability: No availability impact indicated
- CWE / weakness ID: Not specified
Technical Details
The plugin exposes a REST endpoint that queries customer profile information but fails to verify that the requesting user actually owns the customer profile being requested. Because the endpoint lacks an ownership check or adequate authorization validation, an authenticated user can provide identifiers for other users and receive personal data in the response.
The description indicates the exposed fields include email address, name, and roles. No specific functions or endpoint paths are named in the available data; the issue is described generically as occurring through one of the plugin’s REST endpoints.
The practical impact is limited to disclosure of user profile information accessible via that endpoint. The vulnerability does not, in the provided data, describe remote code execution, privilege escalation, or direct site takeover.
How This Could Impact Your Website
Consider a small e-commerce site using this plugin where the site owner manages settings, an internal staff member handles orders, and an external contractor manages product listings. An authenticated user who is only a customer could use the vulnerable endpoint to retrieve other customers’ email addresses and names. Those exposed email addresses could be used to send targeted phishing messages that appear to come from within the organization, or to craft social engineering attempts against staff or contractors who share similar contact patterns.
Exposure of user roles could also reveal which accounts have elevated capabilities, assisting an attacker in focusing social engineering or credential-based attacks. If you reassign or remove users frequently, stale or exposed contact data could increase the risk surface for targeted campaigns.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and subscriber permissions where not needed.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual API requests or data access patterns.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
