CVE-2026-103323: WooCommerce Epos Integration Disclosure Flaw

CVE-2026-103323 Overview

CVE-2026-103323 is a missing authorization vulnerability [CWE-862] in the Integration for Epos Now and WooCommerce WordPress plugin before version 4.11.2. The plugin exposes a REST endpoint without performing any authorization checks. Unauthenticated remote attackers can query the endpoint to retrieve the site's scheduled background tasks and their arguments. These arguments include WooCommerce order identifiers. When WooCommerce's deferred emails feature is enabled, the exposed data also includes plaintext passwords of newly registered customers.

Critical Impact
Unauthenticated attackers can harvest plaintext customer passwords and order metadata from affected WooCommerce storefronts over the network.

Affected Products

Integration for Epos Now and WooCommerce WordPress plugin versions prior to 4.11.2
WordPress sites running WooCommerce with the deferred emails feature enabled
E-commerce deployments integrating Epos Now point-of-sale with WooCommerce

Discovery Timeline

2026-10-07 - CVE CVE-2026-103323 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-103323

Vulnerability Analysis

The plugin registers a REST API endpoint intended to expose internal task-scheduling state. The endpoint lacks a permission_callback or equivalent authorization logic. Any unauthenticated HTTP client can call the endpoint and receive a serialized list of scheduled background tasks along with their arguments.

The exposed arguments are the most sensitive part of the response. WooCommerce queues background jobs for actions such as order synchronization and account creation emails. When the deferred emails feature is active, the plugin stores the new customer's plaintext password inside the task payload so a worker can later render the welcome email. That payload is returned verbatim by the vulnerable endpoint.

An attacker who repeatedly polls the endpoint can enumerate every queued task before it is processed. This yields a stream of newly registered customer credentials and order identifiers that can be reused for account takeover, order lookup, or correlation against other breached datasets.

Root Cause

The root cause is a missing authorization check [CWE-862] on a REST route registered by the plugin. WordPress REST routes require an explicit permission_callback to gate access. The affected route either omits the callback or returns true unconditionally, exposing privileged state to anonymous callers.

Attack Vector

Exploitation requires only network access to the WordPress site. No authentication, user interaction, or elevated privileges are required. An attacker sends an HTTP GET request to the vulnerable REST endpoint and parses the JSON response for task arguments. Successful exploitation discloses confidential data but does not modify site state or availability.

No verified public exploit code is available at this time. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-103323

Indicators of Compromise

Repeated unauthenticated HTTP requests to REST routes registered by the Integration for Epos Now and WooCommerce plugin
Anomalous polling patterns from a single source IP against /wp-json/ endpoints associated with the plugin
Customer accounts reporting unauthorized logins shortly after account creation

Detection Strategies

Inspect web server access logs for GET requests to plugin-specific REST paths originating from unauthenticated clients
Correlate account creation events with subsequent authentication attempts from unexpected geolocations or user agents
Audit the WordPress Action Scheduler log to confirm whether tasks containing credentials were queued while the plugin version was vulnerable

Monitoring Recommendations

Enable REST API request logging on the WordPress host and forward it to a centralized log platform
Alert on high request rates against /wp-json/ paths from a single source
Monitor for password reset activity and account anomalies on recently registered WooCommerce customers

How to Mitigate CVE-2026-103323

Immediate Actions Required

Update the Integration for Epos Now and WooCommerce plugin to version 4.11.2 or later
Force a password reset for any customer accounts created while a vulnerable version was installed
Review web server access logs for prior unauthenticated access to the affected REST endpoint
Temporarily disable the plugin if an immediate patch cannot be applied

Patch Information

The vendor addressed the issue in version 4.11.2 of the Integration for Epos Now and WooCommerce plugin by adding an authorization check to the affected REST endpoint. Administrators should upgrade through the WordPress plugin manager or by replacing the plugin directory with the fixed release. Refer to the WPScan Vulnerability Report for the advisory record.

Workarounds

Deactivate the plugin until the patched release can be installed
Disable the WooCommerce deferred emails feature to prevent plaintext passwords from being stored in scheduled task arguments
Restrict access to /wp-json/ endpoints at the web application firewall for the plugin's routes until the update is deployed

bash

# Example WAF rule to block unauthenticated access to the vulnerable REST route
# Adjust the location match to the exact route exposed by the plugin
location ~* ^/wp-json/.*epos.* {
    if ($http_authorization = "") {
        return 403;
    }
}