CVE-2026-16569: ShopApper WooCommerce Auth Bypass Flaw

CVE-2026-16569 Overview

CVE-2026-16569 affects the Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through version 0.4.62. The plugin exposes a REST endpoint that performs stock-update operations without verifying the caller's capabilities. Any authenticated user, including low-privilege roles such as customer or subscriber, can modify the stock quantity of arbitrary products. The flaw represents a broken access control issue [CWE-862] that undermines inventory integrity for stores relying on the plugin.

Critical Impact

Authenticated low-privilege users can alter product stock quantities across the entire WooCommerce catalog, enabling inventory manipulation, denial of sale, and fraudulent purchase conditions.

Affected Products

• Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin
• All versions up to and including 0.4.62
• WooCommerce stores using this plugin for mobile app integration

Discovery Timeline

• 2026-08-27 - CVE-2026-16569 published to NVD
• 2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-16569

Vulnerability Analysis

The plugin registers a REST API route that handles product stock updates. The route's permission callback fails to enforce a capability check appropriate for inventory management, such as manage_woocommerce or edit_products. Instead, the endpoint treats successful authentication as sufficient authorization.

This behavior allows any logged-in user to submit stock-change requests targeting arbitrary product IDs. An attacker can set stock quantities to zero to block sales, inflate quantities to trigger oversold conditions, or repeatedly toggle values to disrupt fulfillment workflows.

Refer to the WPScan advisory for endpoint specifics and reproduction details.

Root Cause

The root cause is a missing authorization check on the stock-update REST endpoint. The plugin does not validate the requesting user's role or capabilities before executing the update. Authentication alone should never gate write operations that mutate merchant data.

Attack Vector

An attacker registers or compromises any low-privilege WordPress account on the target site. On many WooCommerce stores, self-registration is enabled for customers. The attacker then sends authenticated HTTP requests to the vulnerable REST endpoint with a target product ID and a chosen stock quantity. The server accepts the request and updates the product record.

No social engineering, chained vulnerability, or administrative access is required beyond a standard authenticated session.

Detection Methods for CVE-2026-16569

Indicators of Compromise

• Unexpected changes in the _stock or _stock_status post meta for WooCommerce products.
• REST API requests from non-administrative user sessions targeting plugin-specific stock endpoints.
• WooCommerce audit log entries showing stock adjustments performed by customer or subscriber accounts.

Detection Strategies

• Inspect web server access logs for POST or PUT requests to the plugin's REST namespace originating from low-privilege sessions.
• Correlate WordPress user role data with product update events recorded in the database.
• Deploy a WordPress activity log plugin to alert on stock modifications performed outside of the administrator or shop manager roles.

Monitoring Recommendations

• Track wp_postmeta changes to _stock fields and alert on high-frequency updates.
• Baseline expected REST API callers and flag unusual request volumes to plugin endpoints.
• Monitor new user registrations followed shortly by API activity against product endpoints.

How to Mitigate CVE-2026-16569

Immediate Actions Required

• Deactivate the Mobile App for WooCommerce: ShopApper plugin until a patched release is verified.
• Disable open customer registration on WordPress if it is not required for store operations.
• Audit recent product stock changes and restore accurate quantities from backups or order history.

Patch Information

At the time of publication, no fixed version is listed in the referenced advisory. The vulnerability affects the plugin through version 0.4.62. Monitor the WPScan advisory and the vendor's plugin page for an updated release that adds proper capability checks to the stock-update endpoint.

Workarounds

• Restrict access to the plugin's REST routes at the web server or WAF layer, allowing only administrator IP ranges.
• Use a WordPress security plugin or custom rest_authentication_errors filter to block non-privileged users from accessing plugin REST namespaces.
• Temporarily disable REST API access for the customer and subscriber roles until a patch is available.

# Example: block plugin REST namespace at the nginx layer
location ~ ^/wp-json/shopapper/ {
    allow 203.0.113.0/24;   # admin network
    deny all;
}