CVE-2026-92404 Overview
CVE-2026-92404 is an information disclosure vulnerability in the MgoSync WordPress plugin before version 2.1.7. The plugin exposes a REST API endpoint without authorization checks. Unauthenticated attackers can query this endpoint to retrieve stored WooCommerce API credentials from any site running the affected plugin. The disclosed data includes a read/write consumer key and consumer secret. Attackers holding these credentials can interact with the WooCommerce REST API to read orders, customer data, and modify store content. The vulnerability is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated attackers can retrieve read/write WooCommerce API keys over the network, gaining full programmatic access to the store's WooCommerce data.
Affected Products
- MgoSync WordPress plugin versions prior to 2.1.7
- WordPress sites with MgoSync installed and configured with WooCommerce credentials
- WooCommerce stores integrated through MgoSync
Discovery Timeline
- 2026-09-19 - CVE-2026-92404 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-92404
Vulnerability Analysis
The MgoSync plugin registers a REST API endpoint intended to expose configuration data for legitimate synchronization workflows. The endpoint returns the WooCommerce API credentials the site administrator configured during plugin setup. These credentials typically include a consumer key and consumer secret pair scoped for read/write access to the WooCommerce REST API.
Because the endpoint lacks a permission_callback that enforces authentication or capability checks, any anonymous HTTP client can invoke it. WordPress REST API routes registered without a proper permission callback default to public access, which is the underlying pattern behind this disclosure.
An attacker who retrieves the consumer key and secret can authenticate to /wp-json/wc/v3/ endpoints as if they were the administrator who provisioned the keys. This grants access to customer records, order histories, product data, and write operations across the store.
Root Cause
The root cause is a missing authorization control on a REST API route registered by the plugin. The route handler returns sensitive configuration values without verifying the caller's identity or capabilities. This is a classic instance of [CWE-200] where sensitive data is returned in an API response accessible to unauthenticated actors.
Attack Vector
Exploitation occurs over the network with no authentication and no user interaction. An attacker sends an HTTP GET request to the vulnerable REST endpoint on a target WordPress site. The response includes the stored WooCommerce consumer key and secret. The attacker then reuses those credentials against the WooCommerce REST API to perform authenticated read and write operations against the store. Refer to the WPScan Vulnerability Report for endpoint specifics.
Detection Methods for CVE-2026-92404
Indicators of Compromise
- Unauthenticated HTTP GET requests to MgoSync REST API routes under /wp-json/ from unfamiliar IP addresses
- Subsequent successful WooCommerce REST API calls to /wp-json/wc/v3/orders or /wp-json/wc/v3/customers using the exposed consumer key
- WooCommerce API usage from IP addresses that do not match legitimate integration endpoints
- Unexpected product, coupon, or order modifications correlated with recent REST API activity
Detection Strategies
- Inventory WordPress installations and identify sites running MgoSync at a version lower than 2.1.7
- Query web server access logs for requests to MgoSync REST routes originating from external IPs
- Alert on WooCommerce API key usage from new user agents or geolocations after suspicious REST calls
- Compare stored WooCommerce consumer keys against those observed in API traffic to detect leaked credential reuse
Monitoring Recommendations
- Forward WordPress and WooCommerce access logs to a centralized logging platform for correlation
- Baseline normal WooCommerce REST API consumers and alert on deviations in caller identity or request volume
- Monitor for enumeration patterns that fingerprint MgoSync endpoints across your WordPress estate
- Review WooCommerce audit trails for administrative changes performed via API rather than the admin UI
How to Mitigate CVE-2026-92404
Immediate Actions Required
- Upgrade MgoSync to version 2.1.7 or later on every affected WordPress site
- Rotate all WooCommerce API consumer keys and secrets that were configured in MgoSync prior to patching
- Review WooCommerce API access logs for unauthorized use of the previously exposed credentials
- Restrict the WooCommerce REST API to trusted IP ranges where operationally feasible
Patch Information
The MgoSync maintainers addressed the missing authorization control in version 2.1.7. Sites must update to that release or later. Consult the WPScan Vulnerability Report for the vendor advisory and fixed version reference.
Workarounds
- Deactivate and uninstall the MgoSync plugin until the site can be upgraded to 2.1.7
- Block external access to MgoSync REST routes at the web server or web application firewall layer
- Revoke any WooCommerce API keys stored by MgoSync and reissue them with the minimum required scope after patching
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
