CVE-2026-57649: Shoppable Images Lite Auth Bypass Flaw

CVE-2026-57649 Overview

CVE-2026-57649 is a broken access control vulnerability in the WordPress plugin Shoppable Images Lite (also known as mabel-shoppable-images-lite) affecting versions up to and including 1.3. The flaw allows authenticated users with only the low-privilege Subscriber role to access plugin functionality that should be restricted to higher-privileged users. The weakness is categorized under CWE-862: Missing Authorization.

The vulnerability is exploitable over the network with low attack complexity and requires only low-level authentication. Successful exploitation results in a confidentiality impact, with no direct impact to integrity or availability.

Critical Impact
Authenticated Subscriber-level users can bypass authorization checks in Shoppable Images Lite ≤ 1.3, exposing plugin functionality intended for privileged administrators.

Affected Products

Shoppable Images Lite WordPress plugin (mabel-shoppable-images-lite)
Versions 1.3 and earlier
WordPress installations with the plugin activated and Subscriber registration enabled

Discovery Timeline

2026-06-26 - CVE-2026-57649 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57649

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the Shoppable Images Lite plugin. Plugin endpoints that manage or expose functionality do not verify whether the requesting user holds an appropriate capability. As a result, any authenticated user, including those assigned the default Subscriber role, can invoke these endpoints and retrieve data intended for administrators.

WordPress Subscribers are the lowest-privileged authenticated role. Many WordPress sites permit open registration, meaning attackers can self-provision a Subscriber account without administrator involvement. Once registered, an attacker holds valid session credentials and can send requests directly to the vulnerable plugin handlers.

Because the flaw is limited to confidentiality with no impact to integrity or availability, exploitation exposes information but does not permit direct modification of site content or denial of service. However, disclosed data may aid further attacks against the site.

Root Cause

The root cause is missing capability checks in the plugin's request handlers. The affected code paths accept requests without calling current_user_can() or equivalent capability validation before returning results. This design defect maps directly to CWE-862: Missing Authorization.

Attack Vector

An attacker registers or obtains a Subscriber account on a WordPress site running Shoppable Images Lite ≤ 1.3. The attacker then issues authenticated HTTP requests to the plugin's endpoints. Because the plugin does not verify the caller's role, the endpoint returns data or performs actions that should be reserved for privileged roles. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2026-57649

Indicators of Compromise

Unexpected authenticated requests from Subscriber-role accounts to admin-ajax.php or plugin REST endpoints associated with mabel-shoppable-images-lite.
Newly registered Subscriber accounts that immediately access plugin functionality with no browsing activity on public content.
Access log entries showing repeated requests to plugin action handlers from low-privilege session cookies.

Detection Strategies

Review WordPress access logs for requests to Shoppable Images Lite endpoints originating from non-administrator sessions.
Enable audit logging plugins to record capability checks and authenticated action invocations by user role.
Correlate account creation events with subsequent plugin endpoint access to identify probing behavior.

Monitoring Recommendations

Monitor spikes in Subscriber registrations followed by API or AJAX activity within short time windows.
Alert on 200-level HTTP responses to plugin endpoints when the requesting user role is Subscriber or lower.
Track outbound data volume from admin-ajax.php responses to detect bulk information retrieval.

How to Mitigate CVE-2026-57649

Immediate Actions Required

Update Shoppable Images Lite to a version later than 1.3 as soon as the vendor publishes a fixed release.
Disable or deactivate the plugin if a patched version is not yet available and the functionality is not business-critical.
Audit existing Subscriber accounts and remove any that appear suspicious or unused.

Patch Information

Refer to the Patchstack Vulnerability Report for current patch availability and vendor guidance. Apply the vendor-supplied update through the WordPress plugin management interface once released.

Workarounds

Disable open user registration in WordPress settings to prevent attackers from obtaining Subscriber accounts.
Restrict access to wp-admin/admin-ajax.php and plugin REST routes via web application firewall rules until a patch is applied.
Temporarily remove the plugin from production sites where the shoppable image feature is not actively used.

bash

# Disable open registration via wp-cli
wp option update users_can_register 0

# Deactivate the vulnerable plugin
wp plugin deactivate mabel-shoppable-images-lite