{
 "id": "WPSEC-2026-1492",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1492/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1492/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1492/index.md",
 "title": "WowStore <= 4.5.8 - Unauthenticated Insecure Direct Object Reference via Product Preview REST Endpoint",
 "description": "The product-blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.8 via the product preview REST endpoint (/wopb/preview). This is due to the route being publicly accessible, being protected only by a nonce that is exposed to front-end visitors, and accepting an arbitrary product ID without checking whether the requester can read that product. This makes it possible for unauthenticated attackers to retrieve the title, description, short description, prices, SKU and other details of draft, pending, private or password-protected products.",
 "plugin": {
  "slug": "product-blocks",
  "name": "WowStore",
  "full_name": "WowStore – Store Builder & Product Blocks for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/product-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/product-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/product-blocks"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.6.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.6.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.6.0",
 "remediation": "Update to 4.6.0 or later.",
 "fix_released": "2026-10-22T05:27:43+00:00",
 "published": "2026-10-23T05:44:15+00:00",
 "updated": "2026-10-22T09:33:08.393641+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1492/",
  "https://plugins.svn.wordpress.org/product-blocks/tags/4.6.0/",
  "https://wordpress.org/plugins/product-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/product-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-24"
 }
}