CVE-2026-16568CWE-639

CVE-2026-16568

Medium · published August 27, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
4.5
In the wild
Unconfirmed
What it is

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00157 · 4.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-27T10:16Z
References (1)
https://wpscan.com/vulnerability/489be79d-df68-4384-83ab-c3fa5400eadc/ · [email protected]
EPSS history
Timeline
  • 28 AUG 06:31Z
    EPSS moved — → 0%
    epss
  • 27 AUG 06:00Z
    ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR
    cvelistv5