FoxyShop <= 4.9.7 - Unauthenticated Privilege Escalation via Predictable API Key
- ID
- WPSEC-2026-0667
- Plugin
- FoxyShop (foxyshop)
- Affected
- all versions before 4.9.8
- Remediation
- Update to 4.9.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-330
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-08
- Attack surface
- FoxyShop on WPSec AttackSurface
- Fix released
- Published
Description
The FoxyShop plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.7. The store API key that authenticates FoxyCart datafeeds and single sign-on return links was generated from a small random value and the time of generation, so it can be recovered. Datafeeds signed with the key could set the password of any existing user matched by email address, including administrators, and single sign-on links could log in any user linked to a FoxyCart customer. This makes it possible for unauthenticated attackers who recover the key to take over user accounts, including administrator accounts. Sites must reset the API key after updating.
References
- https://wpsec.com/vuln/WPSEC-2026-0667/
- https://plugins.svn.wordpress.org/foxyshop/tags/4.9.8/
- https://wordpress.org/plugins/foxyshop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS