# FoxyShop <= 4.9.7 - Unauthenticated Privilege Escalation via Predictable API Key

- **ID:** WPSEC-2026-0667
- **Plugin:** FoxyShop (`foxyshop`), https://wordpress.org/plugins/foxyshop/
- **Affected versions:** all versions before 4.9.8
- **Fixed in:** 4.9.8 (Update to 4.9.8 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-330
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/foxyshop
- **Fix released:** 2026-10-07
- **Published:** 2026-10-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0667/

## Description

The FoxyShop plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.7. The store API key that authenticates FoxyCart datafeeds and single sign-on return links was generated from a small random value and the time of generation, so it can be recovered. Datafeeds signed with the key could set the password of any existing user matched by email address, including administrators, and single sign-on links could log in any user linked to a FoxyCart customer. This makes it possible for unauthenticated attackers who recover the key to take over user accounts, including administrator accounts. Sites must reset the API key after updating.

## References

- https://wpsec.com/vuln/WPSEC-2026-0667/
- https://plugins.svn.wordpress.org/foxyshop/tags/4.9.8/
- https://wordpress.org/plugins/foxyshop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0667/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.