CVE-2026-32372: ShopBuilder Information Disclosure Flaw

CVE-2026-32372 Overview

CVE-2026-32372 is an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability affecting the RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons plugin for WordPress. This vulnerability allows unauthenticated attackers to retrieve embedded sensitive data from affected WordPress installations running vulnerable versions of the ShopBuilder plugin.

The vulnerability stems from improper information handling within the plugin, potentially exposing sensitive system configuration details, internal paths, or other confidential data that should not be accessible to unauthorized users.

Critical Impact

Unauthenticated attackers can remotely extract sensitive system information from affected WordPress sites without any user interaction, potentially aiding in further attacks against the target environment.

Affected Products

• ShopBuilder – Elementor WooCommerce Builder Addons versions up to and including 3.2.4
• WordPress installations using the affected ShopBuilder plugin
• WooCommerce stores utilizing ShopBuilder for storefront customization

Discovery Timeline

• 2026-03-13 - CVE-2026-32372 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-32372

Vulnerability Analysis

This vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), indicating that the ShopBuilder plugin inadvertently exposes sensitive system information to parties who should not have access to it.

The vulnerability is network-exploitable, requiring no authentication or user interaction, which significantly lowers the barrier for exploitation. While the impact is limited to confidentiality exposure without direct integrity or availability consequences, the leaked information could serve as reconnaissance data for attackers planning more sophisticated attacks against the WordPress installation.

Root Cause

The root cause of this vulnerability lies in improper access controls within the ShopBuilder plugin that allow sensitive system information to be retrieved by unauthorized users. The plugin fails to adequately protect certain endpoints or data structures that contain or reference sensitive system details, making them accessible to unauthenticated requests.

This type of information disclosure typically occurs when:

• Debug information is left accessible in production environments
• System paths or configuration details are embedded in client-facing responses
• Internal API endpoints lack proper authentication checks
• Error handling reveals sensitive internal state information

Attack Vector

The attack vector is network-based, allowing remote exploitation without requiring any privileges or user interaction. An attacker can send specially crafted requests to the vulnerable WordPress site to extract sensitive embedded data from the ShopBuilder plugin.

The exploitation process involves identifying WordPress sites running vulnerable versions of ShopBuilder and sending requests to endpoints or features that leak sensitive system information. This information could include server paths, configuration details, database structure hints, or other internal data useful for planning subsequent attacks.

For technical details on the vulnerability mechanism and exploitation, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-32372

Indicators of Compromise

• Unusual or repeated requests to ShopBuilder plugin endpoints from external IP addresses
• Access log entries showing enumeration attempts against plugin-specific URLs
• Unexpected queries or requests targeting plugin assets or AJAX handlers
• Traffic patterns indicating automated scanning for WordPress plugin vulnerabilities

Detection Strategies

• Monitor web server access logs for suspicious requests to /wp-content/plugins/shopbuilder/ paths
• Implement Web Application Firewall (WAF) rules to detect and block information disclosure attack patterns
• Deploy intrusion detection signatures for WordPress plugin exploitation attempts
• Review application logs for error messages or responses that may indicate information leakage

Monitoring Recommendations

• Enable verbose logging on WordPress installations to capture detailed request information
• Configure alerting for unusual traffic patterns targeting plugin directories
• Implement real-time monitoring of WordPress REST API and AJAX endpoints
• Regularly audit plugin versions and compare against known vulnerable versions

How to Mitigate CVE-2026-32372

Immediate Actions Required

• Update ShopBuilder – Elementor WooCommerce Builder Addons to a version newer than 3.2.4 immediately
• Review web server logs for any signs of exploitation attempts
• Audit exposed system information and assess potential impact if data was already leaked
• Consider temporarily disabling the ShopBuilder plugin if an immediate update is not possible

Patch Information

RadiusTheme has addressed this vulnerability in versions released after 3.2.4. Site administrators should update to the latest available version of the ShopBuilder plugin through the WordPress dashboard or by downloading the updated plugin directly from the WordPress plugin repository.

For detailed patch information and version history, consult the Patchstack Vulnerability Report.

Workarounds

• Restrict access to the WordPress admin area and plugin directories using .htaccess rules or server configuration
• Implement a Web Application Firewall (WAF) to filter malicious requests targeting known vulnerable endpoints
• Disable unnecessary plugin features until the patch can be applied
• Use WordPress security plugins to add additional access controls and monitoring

# Example .htaccess rule to restrict direct access to plugin directory
<Directory "/var/www/html/wp-content/plugins/shopbuilder">
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
</Directory>