CVE-2026-7529: wiseCampaign WordPress Auth Bypass Flaw

CVE-2026-7529 Overview

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress contains a missing authorization flaw ([CWE-862]) affecting all versions up to and including 1.1.16. Every REST API endpoint in the plugin is registered with permission_callback => '__return_true', disabling capability and nonce checks. Unauthenticated attackers can read and modify banner records, toggle stockbar and feature flags, change the active banner, and upload background-image files through wp_handle_upload(). The vulnerability enables unauthorized data modification on any WordPress site running the affected plugin.

Critical Impact
Remote, unauthenticated attackers can modify plugin settings and upload files to WooCommerce storefronts without any authentication or nonce validation.

Affected Products

wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress
All versions up to and including 1.1.16
WooCommerce storefronts with the plugin activated

Discovery Timeline

2026-08-05 - CVE-2026-7529 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-7529

Vulnerability Analysis

The vulnerability stems from insecure REST API registration across the plugin's PHP classes. Each register_rest_route() call declares permission_callback => '__return_true', which unconditionally grants access to any HTTP client. WordPress treats this callback as authoritative, so no capability check, nonce verification, or session validation occurs before the endpoint handler runs.

Affected handlers appear in Banner.php, Menu.php, StockBar.php, and WiseBannerV2.php. These handlers expose write operations including saving banner records, updating the active banner, toggling stockbar and feature flags, and invoking wp_handle_upload() to accept file uploads. Because the file upload path is reachable without authentication, an attacker can place attacker-controlled files into the WordPress uploads directory.

The impact is limited to integrity per the CVSS vector, but chained abuse of uploaded content or altered store banners can enable defacement, phishing, and downstream customer-targeted attacks.

Root Cause

The root cause is a broken access control pattern: developers set permission_callback to __return_true to satisfy WordPress's requirement that REST routes declare a callback, rather than implementing an actual permission check with current_user_can() or nonce validation via wp_verify_nonce(). This is a textbook [CWE-862] Missing Authorization defect.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends HTTP requests directly to the plugin's REST namespace, targeting the vulnerable routes registered in the referenced class files. No credentials, session cookies, or nonces are required. Public-facing WooCommerce storefronts are exposed by default. See the vendor source references for the specific vulnerable route registrations in Banner.php, Menu.php, StockBar.php, and WiseBannerV2.php.

Detection Methods for CVE-2026-7529

Indicators of Compromise

Unexpected files in wp-content/uploads/ created without a matching authenticated admin session
Modified banner or stockbar configuration records in the WordPress database without a corresponding administrator audit entry
HTTP requests to the plugin's wp-json/ REST namespace from external IP addresses outside normal admin ranges
New or altered active banner assets referencing untrusted external URLs

Detection Strategies

Inspect web server access logs for unauthenticated POST requests targeting REST endpoints registered by Banner.php, Menu.php, StockBar.php, or WiseBannerV2.php
Monitor for calls to wp_handle_upload() originating from unauthenticated REST sessions in application logs
Alert on file creation events in the WordPress uploads directory that do not correlate with an authenticated admin action

Monitoring Recommendations

Enable WordPress REST API request logging and forward logs to a centralized analytics pipeline for correlation
Track configuration table changes for the wiseCampaign plugin and alert on modifications outside change windows
Baseline normal REST traffic volume to the plugin namespace and alert on anomalous spikes from single source IPs

How to Mitigate CVE-2026-7529

Immediate Actions Required

Update the wiseCampaign plugin to a version later than 1.1.16 that includes the fix from changeset 3529781
If no fixed version is available in your environment, deactivate and remove the plugin until a patched release is deployed
Audit the WordPress uploads directory for files created since the plugin was installed and remove any that are not attributable to legitimate admin activity

Patch Information

The vendor addressed the issue in the trunk changeset published as WordPress Wisecampaign Changeset 3529781. Additional analysis is available from the Wordfence Vulnerability record 9a47e6ff. Site operators should verify the installed plugin version and confirm the patched build is deployed across all WordPress instances.

Workarounds

Block external access to the plugin's REST API namespace at the web application firewall (WAF) or reverse proxy layer
Restrict /wp-json/ traffic to authenticated administrator IP ranges until a patch is applied
Disable the plugin entirely on production storefronts where the wiseCampaign functionality is not required

bash

# Example WAF rule to block unauthenticated POST requests to the plugin REST namespace
# Replace <plugin-namespace> with the actual REST namespace observed in server logs
SecRule REQUEST_URI "@beginsWith /wp-json/<plugin-namespace>/" \
  "id:1002026,\
   phase:1,\
   deny,\
   status:403,\
   chain"
  SecRule REQUEST_METHOD "@rx ^(POST|PUT|PATCH|DELETE)$" \
    "chain"
    SecRule &REQUEST_HEADERS:Cookie "@eq 0"