CVE-2026-27330: WooCommerce Mobile App Auth Bypass Flaw

CVE-2026-27330 Overview

CVE-2026-27330 is a broken access control vulnerability affecting the Mobile App for WooCommerce WordPress plugin in versions up to and including 0.4.62. The flaw allows unauthenticated attackers to access functionality that should require authorization, mapped to [CWE-862] Missing Authorization. Because the plugin extends WooCommerce storefronts through a mobile API surface, exposed endpoints can affect customer data, order records, and store configuration. The vulnerability is exploitable over the network with low attack complexity and no user interaction.

Critical Impact
Unauthenticated attackers can invoke protected plugin actions across affected WordPress sites, resulting in high confidentiality impact and integrity and availability degradation on WooCommerce stores.

Affected Products

Mobile App for WooCommerce plugin for WordPress
Versions less than or equal to 0.4.62
WooCommerce-based storefronts running the vulnerable plugin

Discovery Timeline

2026-08-27 - CVE-2026-27330 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-27330

Vulnerability Analysis

The Mobile App for WooCommerce plugin exposes REST or AJAX endpoints intended for the mobile client. In versions through 0.4.62, one or more of these endpoints do not enforce authorization checks. An unauthenticated attacker can call the endpoints directly and perform actions the plugin reserves for authenticated users or administrators.

Broken access control at the plugin layer bypasses WordPress role and capability enforcement. Because the plugin serves as a bridge between an external mobile client and the WooCommerce backend, protected data flows through it. Attackers reaching these endpoints can retrieve or modify data without holding a valid session or nonce.

The Patchstack advisory tracks this issue as a broken access control weakness in the plugin's API layer. Refer to the Patchstack Vulnerability Report for the vendor-reviewed technical write-up.

Root Cause

The root cause is missing authorization enforcement [CWE-862]. Plugin request handlers do not validate that the caller possesses the required capability, nonce, or authenticated user context before executing sensitive operations. WordPress plugins typically enforce this through permission_callback on register_rest_route or current_user_can checks in AJAX handlers. When these guards are absent, any network client can invoke the handler.

Attack Vector

An attacker sends crafted HTTP requests directly to the exposed plugin endpoints on a target WordPress site. No credentials, tokens, or user interaction are required. The attacker enumerates the plugin's routes, sends parameters matching the handler signature, and receives data or triggers state changes. Automated scanners can identify vulnerable installations by fingerprinting the plugin version through the WordPress readme file or public assets.

No verified proof-of-concept code has been published. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-27330

Indicators of Compromise

Unauthenticated HTTP requests to /wp-json/ routes registered by the Mobile App for WooCommerce plugin or to admin-ajax.php with plugin-specific action parameters
Successful 200 responses to plugin endpoints originating from IP addresses that never authenticated to wp-login.php
Unexpected changes to WooCommerce orders, products, or customer records with no corresponding admin session in access logs

Detection Strategies

Inventory WordPress sites and identify installations of the Mobile App for WooCommerce plugin at version 0.4.62 or earlier
Review web server access logs for high-volume or scripted access to plugin REST routes without prior authentication cookies
Correlate WooCommerce database change events with the authenticated user set to confirm all modifications map to a valid session

Monitoring Recommendations

Enable request logging on wp-json and admin-ajax.php endpoints with source IP and user agent
Alert on anonymous requests that return sensitive JSON payloads such as customer emails, order IDs, or address fields
Track plugin version drift across WordPress fleets and flag any host still exposing the vulnerable release

How to Mitigate CVE-2026-27330

Immediate Actions Required

Upgrade the Mobile App for WooCommerce plugin to a version later than 0.4.62 as soon as the vendor publishes a fixed release
Restrict network access to the WordPress admin and REST API surface using a web application firewall or reverse proxy allowlist
Audit WooCommerce order, product, and customer tables for unauthorized changes since the plugin was installed

Patch Information

At publication, the Patchstack Vulnerability Report is the authoritative reference. Administrators should monitor the plugin listing on WordPress.org and apply the vendor-supplied update covering versions above 0.4.62.

Workarounds

Deactivate and remove the Mobile App for WooCommerce plugin until a patched version is available
Block unauthenticated requests to the plugin's REST namespaces at the web application firewall layer
Require authentication at the reverse proxy for any path used by the mobile client, pairing it with client certificates or an API gateway token

bash

# Example: block anonymous access to the plugin's REST routes in nginx
location ~* /wp-json/mobile-app-for-woocommerce/ {
    if ($http_authorization = "") {
        return 401;
    }
    proxy_pass http://wordpress_upstream;
}