Security Alert Summary
The ShopSmart Loyalty for WooCommerce plugin through 1.0.0 exposes a phone-number lookup to unauthenticated users without authorization or ownership checks. An attacker who knows a customer’s phone number can retrieve that customer’s loyalty profile, including name, email address, and account balance.
CVE Details
- CVE ID: CVE-2026-14832
- Affected component: ShopSmart Loyalty for WooCommerce
- Affected versions: through 1.0.0 (<= 1.0.0)
- Published: August 17, 2026 at 06:17:31 AM UTC
- Last modified: August 17, 2026 at 04:16:48 PM UTC
- CVSS v3.1: Base score 5.3 – MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Vector:
- Authentication / Privileges / User Interaction: No authentication required; privileges required: NONE; user interaction: NONE; attack vector: NETWORK; attack complexity: LOW
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- CWE / weakness: CWE-639
Technical Details
The plugin provides a phone-number lookup that does not perform authorization or ownership checks and is accessible to unauthenticated users. Because the lookup accepts a phone number and returns a loyalty profile, anyone who knows or guesses a customer’s phone number can retrieve profile fields specified in the report, including name, email, and account balance.
No specific functions or REST endpoints are named in the available data; the core issue is the absence of access control on the lookup functionality. The vulnerability exists because the plugin fails to verify that the requestor is authorized to access the loyalty data for the given phone number.
Impact is limited to disclosure of the loyalty profile fields described. There is no indication in the provided data of write access, site-wide privilege escalation, or availability impact.
How This Could Impact Your Website
Consider a small online store using this loyalty plugin with several user roles: the site owner, a store manager, internal staff who process orders, and external contractors who may help with marketing. If the phone-number lookup is exposed, an external actor who knows a customer’s phone number could retrieve that customer’s loyalty profile. This could reveal customer names and email addresses maintained in loyalty records and disclose account balances tied to loyalty accounts.
Practical consequences include increased exposure of customer contact details that could be used for targeted phishing or social engineering against staff or customers. For example, a contractor with limited access to the site could be targeted by an email that references a loyalty balance, making the message appear more legitimate. Internal staff email addresses stored in loyalty records could also be harvested in bulk if multiple numbers are known.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege roles with data access.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and access logs for unusual behavior or unexpected data queries that reference customer phone numbers.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
