{
 "id": "WPSEC-2026-1232",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1232/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1232/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1232/index.md",
 "title": "VietQR <= 3.6.0 - Unauthenticated Sensitive Information Exposure via vietqr/developer API Endpoint",
 "description": "The VietQR plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'vietqr/developer' WooCommerce API endpoint in all versions up to, and including, 3.6.0. The endpoint has no capability or nonce check and returns the gateway's configuration as JSON. This makes it possible for unauthenticated attackers to retrieve the configured bank account details, developer ID, order prefix, site name, PHP version and WordPress version.",
 "plugin": {
  "slug": "vietqr",
  "name": "VietQR",
  "full_name": "VietQR",
  "wordpress_org": "https://wordpress.org/plugins/vietqr/",
  "advisories_url": "https://wpsec.com/vuln/plugin/vietqr/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/vietqr"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.7.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.7.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.7.0",
 "remediation": "Update to 3.7.0 or later.",
 "fix_released": "2026-10-17T18:41:33+00:00",
 "published": "2026-10-18T19:43:08+00:00",
 "updated": "2026-10-18T10:55:45.071985+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1232/",
  "https://plugins.svn.wordpress.org/vietqr/tags/3.7.0/",
  "https://wordpress.org/plugins/vietqr/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/vietqr",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-18"
 }
}