Security Alert Summary
The WPC Smart Compare for WooCommerce plugin before 6.6.1 fails to apply WordPress post-password protection when returning product content via its comparison handler. This allows unauthenticated users to read the description text of password-protected products.
CVE Details
- CVE ID: CVE-2026-90985
- Affected component: WPC Smart Compare for WooCommerce (comparison handler)
- Affected versions: Versions before 6.6.1 (per provided data)
- Published: September 23, 2026 at 6:17:05 AM UTC
- Last modified: September 23, 2026 at 11:17:17 AM UTC
- CVSS v3.1: Base Score 5.3, MEDIUM; Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Authentication / Privileges / User interaction: No authentication or privileges required (PR:N); no user interaction required (UI:N)
- Primary impact: Confidentiality: LOW; Integrity: NONE; Availability: NONE
- Weakness: CWE-200 (Information Exposure)
Technical Details
According to the advisory, the plugin’s comparison handler returns product content without applying WordPress post-password protection checks. As a result, when the handler prepares and returns product descriptions for comparison, it may include the description text of products that are protected by a post password. The behavior exists because the comparison handler does not enforce the same post-password gating that WordPress applies to normal post output.
The observable impact is limited to disclosure of product description content that would otherwise be hidden behind a post password. The report does not name specific PHP functions or REST endpoints beyond referring to the comparison handler, and it does not indicate additional privilege escalation, integrity modification, or availability effects.
How This Could Impact Your Website
Consider a typical site workflow where a site owner manages product visibility, internal staff manage product data, and external contractors or contributors prepare product descriptions. If a product description or comparison content includes sensitive details (for example, internal contact information, pre-release product specifications, or other non-public notes), those fields could be exposed to unauthenticated visitors through the plugin’s comparison feature. This exposure can increase the risk of targeted phishing or social engineering if attackers obtain usable information from product text. The issue does not, based on the provided data, allow modification of content or disruption of site availability.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review product descriptions and comparison content for any sensitive or private information; remove or relocate such content where appropriate.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual behavior related to product or comparison endpoints.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
