CVE-2026-90985: WPC Smart Compare Information Disclosure Flaw

CVE-2026-90985 Overview

CVE-2026-90985 is an information disclosure vulnerability in the WPC Smart Compare for WooCommerce WordPress plugin before version 6.6.1. The plugin's product comparison handler returns product content without enforcing WordPress's built-in post-password protection. Unauthenticated attackers can read the descriptions of password-protected products through the comparison endpoint. The issue is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Unauthenticated remote users can retrieve descriptions of password-protected WooCommerce products, bypassing the site owner's access-control intent for gated product content.

Affected Products

WPC Smart Compare for WooCommerce WordPress plugin versions prior to 6.6.1
WordPress sites running WooCommerce with password-protected products
Any deployment relying on WordPress post-password protection for product privacy

Discovery Timeline

2026-09-23 - CVE-2026-90985 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-90985

Vulnerability Analysis

WordPress supports per-post password protection, requiring visitors to supply a password before core template functions render post content. WooCommerce products inherit this behavior when a product password is set. The WPC Smart Compare for WooCommerce plugin exposes a comparison handler that fetches and returns product content for arbitrary product IDs. The handler retrieves the product description directly without checking post_password_required() against the requested product.

An attacker can call the comparison endpoint with the ID of a password-protected product and receive its description in the response. The disclosure is limited to product content the plugin returns through comparison output, so integrity and availability are not affected.

Root Cause

The root cause is missing access-control enforcement in the plugin's comparison output path. WordPress delegates password gating to caller code that must invoke post_password_required() or use template functions that honor it. The plugin's handler bypasses this check when assembling comparison payloads, so protected content is emitted regardless of session state or supplied password.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker enumerates or guesses product IDs, then issues an unauthenticated request to the plugin's comparison AJAX or REST handler referencing the target product. The response body contains the description of the password-protected product. See the WPScan Vulnerability Report for handler-level technical details.

Detection Methods for CVE-2026-90985

Indicators of Compromise

Unauthenticated requests to WPC Smart Compare AJAX actions or REST routes referencing product IDs that are password-protected in the WordPress database.
Repeated comparison requests iterating sequential or enumerated product_id parameters from a single source.
HTTP 200 responses containing product description fields for products marked with a non-empty post_password value.

Detection Strategies

Inspect web server access logs for requests to the plugin's compare endpoint that were not preceded by an authenticated session or a password submission on the target product.
Correlate database queries selecting password-protected products against the source IP of the plugin's comparison handler invocations.
Deploy a WAF rule that flags comparison requests whose response payload references product IDs with a set post_password field.

Monitoring Recommendations

Enable verbose logging on the WordPress admin-ajax.php and REST API endpoints handled by WPC Smart Compare.
Alert on volumetric enumeration patterns against product comparison endpoints, especially from unauthenticated sources.
Track outbound response sizes from comparison endpoints to identify large descriptions being returned to unauthenticated clients.

How to Mitigate CVE-2026-90985

Immediate Actions Required

Upgrade WPC Smart Compare for WooCommerce to version 6.6.1 or later on all WordPress installations.
Audit WooCommerce products that rely on WordPress post-password protection to determine whether any descriptions may have been disclosed.
Restrict access to the plugin's comparison endpoints at the WAF layer until the update is confirmed deployed.

Patch Information

The vendor addressed the issue in WPC Smart Compare for WooCommerce version 6.6.1 by enforcing post_password_required() in the comparison handler before returning product content. Confirmation details are available in the WPScan Vulnerability Report.

Workarounds

Disable or uninstall the WPC Smart Compare for WooCommerce plugin until the site is updated to 6.6.1 or later.
Remove password-protected products from the compare list or set them to private visibility so they are not returned by the handler.
Add a server-level access rule blocking unauthenticated requests to the plugin's comparison AJAX action and REST route.

bash

# Configuration example: block unauthenticated compare requests at the web server
# Nginx snippet - reject anonymous access to the compare AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "woosc_get_compare") {
        set $block 1;
    }
    if ($http_cookie !~* "wordpress_logged_in") {
        set $block "${block}1";
    }
    if ($block = "11") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}