CVE-2026-16568: WooCommerce ShopApper Information Disclosure

CVE-2026-16568 Overview

CVE-2026-16568 is a broken access control vulnerability in the Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through version 0.4.62. The plugin exposes a REST API endpoint that returns customer profile data without verifying ownership of the requested profile. Any authenticated user, including low-privilege subscriber or customer accounts, can query the endpoint and retrieve other users' personal data. Exposed fields include email addresses, names, and assigned WordPress roles. The flaw maps to Insecure Direct Object Reference [CWE-639] and broken access control [CWE-284].

Critical Impact
Any authenticated WooCommerce customer can enumerate and exfiltrate personal data belonging to other registered users through an unprotected REST endpoint.

Affected Products

Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce (WordPress plugin)
All versions up to and including 0.4.62
WordPress sites running WooCommerce with the ShopApper plugin enabled

Discovery Timeline

2026-08-27 - CVE-2026-16568 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-16568

Vulnerability Analysis

The ShopApper plugin registers a REST API route intended to return customer profile information for the currently authenticated user. The endpoint accepts a user identifier as an input parameter but does not compare it against the identifier of the authenticated requester. As a result, the endpoint returns profile data for any user ID supplied.

An attacker registers a normal customer or subscriber account, authenticates against the WordPress REST API, and iterates over user IDs. Each request returns another user's email address, display name, and WordPress role. Repeated requests allow full enumeration of the site's user base.

The leaked role field additionally reveals administrator and shop manager accounts. This information supports follow-on credential stuffing, phishing, and targeted account-takeover attempts against high-value users.

Root Cause

The REST endpoint's permission callback checks only that the requester is logged in. It omits an authorization check that ties the requested resource identifier to the authenticated user's own ID. This is a classic Insecure Direct Object Reference pattern in which authentication is treated as sufficient authorization.

Attack Vector

Exploitation requires a valid authenticated session on the target WordPress site. Because WooCommerce storefronts typically allow open customer registration, the barrier to obtaining that session is minimal. The attacker then issues authenticated HTTP requests to the vulnerable REST route, substituting arbitrary user IDs, and parses the JSON response to harvest personal data.

See the WPScan Vulnerability Advisory for technical details on the affected endpoint.

Detection Methods for CVE-2026-16568

Indicators of Compromise

Sequential or high-volume authenticated GET requests to the ShopApper plugin's REST API namespace originating from a single customer or subscriber account.
REST API responses containing user email addresses and roles served to non-administrative sessions.
Newly registered customer accounts that immediately begin issuing REST calls to profile-related endpoints.

Detection Strategies

Enable WordPress and WooCommerce REST API request logging and alert on repeated requests to ShopApper plugin routes referencing varying user IDs.
Correlate authenticated REST calls with the requester's user ID and flag responses that return profile data for a different user.
Review web server access logs for enumeration patterns such as monotonically increasing numeric identifiers in query parameters.

Monitoring Recommendations

Track REST API response sizes and rates per authenticated session to identify bulk data collection.
Alert when low-privilege accounts access endpoints that return email addresses or role fields.
Monitor new customer registrations followed by immediate API activity within a short time window.

How to Mitigate CVE-2026-16568

Immediate Actions Required

Disable the Mobile App for WooCommerce: ShopApper plugin until a patched release is available.
Audit WordPress user accounts and rotate credentials for administrators and shop managers whose data may have been exposed.
Restrict the WordPress REST API to authenticated administrative contexts where the mobile app integration is not actively used.

Patch Information

No fixed version is identified in the advisory at the time of publication. All versions through 0.4.62 are affected. Monitor the WPScan Vulnerability Advisory and the plugin's WordPress.org listing for an updated release, and apply it as soon as it is published.

Workarounds

Deploy a Web Application Firewall rule that blocks unauthenticated and low-privilege access to the ShopApper plugin's REST namespace.
Use a WordPress must-use plugin or custom rest_authentication_errors filter to reject calls to the vulnerable route from non-administrator users.
Temporarily close open customer registration on the storefront to raise the cost of obtaining an authenticated session.

bash

# Example: block ShopApper REST namespace at the web server (nginx)
location ~* /wp-json/shopapper/ {
    return 403;
}