ShopBuilder – WooCommerce Builder For Elementor <= 3.4.2 - Unauthenticated Sensitive Information Exposure via Select2 AJAX Actions
- ID
- WPSEC-2026-2047
- Plugin
- ShopBuilder – WooCommerce Builder For Elementor (shopbuilder)
- Affected
- all versions before 3.4.3
- Remediation
- Update to 3.4.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- ShopBuilder – WooCommerce Builder For Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The ShopBuilder plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'rtsb_select2_object_search' and 'rtsb_select2_get_title' AJAX actions in all versions up to, and including, 3.4.2, due to a missing capability check. The handlers were registered for unauthenticated users, were protected only by a nonce that is printed to every front-end visitor, and accepted any post type, taxonomy or user source the caller supplied. This makes it possible for unauthenticated attackers to retrieve the titles of published posts of any post type, including WooCommerce coupon codes that are not meant to be shown on the front end, as well as terms of any taxonomy and user display names.
References
- https://wpsec.com/vuln/WPSEC-2026-2047/
- https://plugins.svn.wordpress.org/shopbuilder/tags/3.4.3/
- https://wordpress.org/plugins/shopbuilder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS