{
 "id": "WPSEC-2026-0667",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0667/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0667/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0667/index.md",
 "title": "FoxyShop <= 4.9.7 - Unauthenticated Privilege Escalation via Predictable API Key",
 "description": "The FoxyShop plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.7. The store API key that authenticates FoxyCart datafeeds and single sign-on return links was generated from a small random value and the time of generation, so it can be recovered. Datafeeds signed with the key could set the password of any existing user matched by email address, including administrators, and single sign-on links could log in any user linked to a FoxyCart customer. This makes it possible for unauthenticated attackers who recover the key to take over user accounts, including administrator accounts. Sites must reset the API key after updating.",
 "plugin": {
  "slug": "foxyshop",
  "name": "FoxyShop",
  "full_name": "FoxyShop",
  "wordpress_org": "https://wordpress.org/plugins/foxyshop/",
  "advisories_url": "https://wpsec.com/vuln/plugin/foxyshop/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/foxyshop"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-330"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.9.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.9.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.9.8",
 "remediation": "Update to 4.9.8 or later.",
 "fix_released": "2026-10-07T15:44:22+00:00",
 "published": "2026-10-08T15:50:18+00:00",
 "updated": "2026-10-07T18:51:17.910905+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0667/",
  "https://plugins.svn.wordpress.org/foxyshop/tags/4.9.8/",
  "https://wordpress.org/plugins/foxyshop/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/foxyshop",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-08"
 }
}