ShopSmart for WooCommerce <= 1.0.0 Unauthenticated IDOR Sensitive Info Disclosure (CVE-2026-14832)

Vulnerability Overview Vulnerability Name: ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone Vulnerability Type: IDOR (Insecure Direct Object Reference) Description: The plugin does not perform any authorization or ownership checks on phone number lookups, allowing unauthenticated users to retrieve customer loyalty profiles, including names, emails, and account balances. CVE ID: CVE-2026-14832 CVSS Score: 5.3 (medium) Affected Scope Affected Plugin: shopsmart-loyalty-for-woocommerce Patch Status: No known fix available Remediation Current Status: The page indicates that the POC will be revealed on August 28, 2026, to give users time to update. Currently, there is no known fix available. Timeline Public Release Date: 2026-08-14 Added Date: 2026-08-07 Last Updated Date: 2026-08-07 Additional Information Original Researcher: Pedro Pinho Submitter: Pedro Pinho Verification Status: Yes WPVDB ID: 3b651e19-37f5-468e-8d0b-a82bbe04eaf2 References CVE: CVE-2026-14832 Related Vulnerabilities Booking Package < 1.7.17 - Authenticated (Editor+) Privilege Escalation via Account Takeover to updateUser AJAX Action SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure Cocco <= 1.5.1 - Authenticated (Subscriber+) Authenticated Insecure Direct Object Reference School Management System - WPSchoolPress < 2.2.17 - Teacher+ Privilege Escalation GenerateBlocks < 2.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements POC Code POC Code: The page indicates that the POC will be revealed on August 28, 2026; no specific code is currently available.

Goal Reached Thanks to every supporter — we hit 100%!

ShopSmart for WooCommerce <= 1.0.0 Unauthenticated IDOR Sensitive Info Disclosure (CVE-2026-14832)

More from this source