Security Alert Summary
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce plugin (up to 0.4.62) contains a vulnerability that fails to check user capabilities before processing a stock-update request via one of its REST endpoints. This allows any authenticated user, including customers and subscribers, to modify the stock quantity of arbitrary products.
CVE Details
- CVE ID: CVE-2026-16569
- Affected component: Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce (WordPress plugin)
- Affected versions: Versions through 0.4.62 (<= 0.4.62)
- Published: August 27, 2026 at 6:16:56 AM UTC
- Last modified: August 27, 2026 at 6:16:56 AM UTC
- CVSS v3.1: Not provided in the source data
- Authentication / privileges / user interaction: The vulnerability requires an authenticated user. The description indicates that any authenticated role, such as a customer or subscriber, can perform the action. Specific CVSS authentication/privilege/user interaction fields are not provided.
- Primary impact: Integrity (unauthorized modification of product stock quantities). Confidentiality and availability impacts are not indicated in the source data.
- CWE / weakness ID: Not provided in the source data
Technical Details
According to the provided description, a REST endpoint exposed by the plugin allows a stock-update operation without verifying the requesting user’s capabilities. The plugin does not perform appropriate capability checks before processing the request, which means authenticated users who should not have inventory-management rights can change stock quantities for arbitrary products.
The vulnerability exists because server-side authorization (capability or role checks) is absent or incomplete for the stock-update REST endpoint. The result is a direct integrity impact on product data: stock levels can be increased or decreased by users who normally would not be permitted to manage inventory.
No specific function names or endpoint paths are provided in the source data, so only the general REST endpoint behavior and the missing capability check are described here.
How This Could Impact Your Website
In a typical WordPress site with multiple users, the site owner and administrators rely on role separation to prevent customers or low-privilege accounts from modifying store data. With this vulnerability, a logged-in customer or subscriber could alter stock levels for products. Practical consequences include incorrect stock information shown to other customers, inadvertent overselling or underselling of products, and operational confusion for staff handling orders and inventory.
A realistic scenario: a customer account increases stock on a low-inventory product to place an order that otherwise would have been blocked, or decreases stock to make a product appear out of stock. Internal staff may then need to reconcile orders and inventory, and finance or fulfillment processes could be disrupted.
If youâre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors, subscribers, and other non-administrative accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior related to product or inventory changes.
If youâd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
