Vulnerabilities / WowStore / WPSEC-2026-1492
WowStore <= 4.5.8 - Unauthenticated Insecure Direct Object Reference via Product Preview REST Endpoint
Medium 5.3
CWE-639Fixed in 4.6.0
- ID
- WPSEC-2026-1492
- Plugin
- WowStore – Store Builder & Product Blocks for WooCommerce (product-blocks)
- Affected
- all versions before 4.6.0
- Remediation
- Update to 4.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-24
- Attack surface
- WowStore on WPSec AttackSurface
- Fix released
- Published
Description
The product-blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.8 via the product preview REST endpoint (/wopb/preview). This is due to the route being publicly accessible, being protected only by a nonce that is exposed to front-end visitors, and accepting an arbitrary product ID without checking whether the requester can read that product. This makes it possible for unauthenticated attackers to retrieve the title, description, short description, prices, SKU and other details of draft, pending, private or password-protected products.
References
- https://wpsec.com/vuln/WPSEC-2026-1492/
- https://plugins.svn.wordpress.org/product-blocks/tags/4.6.0/
- https://wordpress.org/plugins/product-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS