Critical · published January 22, 2026
🚨 A missing authorization flaw in WooCommerce could allow unauthorized users to access sensitive data — like handing out room keys to the wrong guests! 🔥 Think of it as a hotel where the front desk fails to check IDs. Anyone could walk in and grab a key to any room they fancy without a second thought — that's how easy it is for attackers here! An attacker could waltz right in and gain access to user accounts, exposing personal information, order history, and even changing account settings. It's absolutely devastating for any e-commerce business, putting customer trust at serious risk!
Think of it as a hotel where the front desk fails to check IDs. Anyone could walk in and grab a key to any room they fancy without a second thought — that's how easy it is for attackers here! This vulnerability arises from improperly configured access control security levels in the Registration & Login with Mobile Phone Number plugin for WooCommerce versions up to 1.3.1, allowing unauthorized users to bypass authentication checks.
An attacker could waltz right in and gain access to user accounts, exposing personal information, order history, and even changing account settings. It's absolutely devastating for any e-commerce business, putting customer trust at serious risk! To protect your site, immediately update to the patched version of the plugin. Double-check the access control settings to ensure they’re configured properly, and consider conducting a security audit to spot any similar vulnerabilities. Don’t wait! You can tackle this! Follow these steps and you'll restore your users' trust in no time! 🛡️