# WowStore <= 4.5.8 - Unauthenticated Insecure Direct Object Reference via Product Preview REST Endpoint

- **ID:** WPSEC-2026-1492
- **Plugin:** WowStore – Store Builder & Product Blocks for WooCommerce (`product-blocks`), https://wordpress.org/plugins/product-blocks/
- **Affected versions:** all versions before 4.6.0
- **Fixed in:** 4.6.0 (Update to 4.6.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-24)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/product-blocks
- **Fix released:** 2026-10-22
- **Published:** 2026-10-23
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1492/

## Description

The product-blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.8 via the product preview REST endpoint (/wopb/preview). This is due to the route being publicly accessible, being protected only by a nonce that is exposed to front-end visitors, and accepting an arbitrary product ID without checking whether the requester can read that product. This makes it possible for unauthenticated attackers to retrieve the title, description, short description, prices, SKU and other details of draft, pending, private or password-protected products.

## References

- https://wpsec.com/vuln/WPSEC-2026-1492/
- https://plugins.svn.wordpress.org/product-blocks/tags/4.6.0/
- https://wordpress.org/plugins/product-blocks/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1492/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.