# ShopBuilder – WooCommerce Builder For Elementor <= 3.4.2 - Unauthenticated Sensitive Information Exposure via Select2 AJAX Actions

- **ID:** WPSEC-2026-2047
- **Plugin:** ShopBuilder – WooCommerce Builder For Elementor (`shopbuilder`), https://wordpress.org/plugins/shopbuilder/
- **Affected versions:** all versions before 3.4.3
- **Fixed in:** 3.4.3 (Update to 3.4.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/shopbuilder
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2047/

## Description

The ShopBuilder plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'rtsb_select2_object_search' and 'rtsb_select2_get_title' AJAX actions in all versions up to, and including, 3.4.2, due to a missing capability check. The handlers were registered for unauthenticated users, were protected only by a nonce that is printed to every front-end visitor, and accepted any post type, taxonomy or user source the caller supplied. This makes it possible for unauthenticated attackers to retrieve the titles of published posts of any post type, including WooCommerce coupon codes that are not meant to be shown on the front end, as well as terms of any taxonomy and user display names.

## References

- https://wpsec.com/vuln/WPSEC-2026-2047/
- https://plugins.svn.wordpress.org/shopbuilder/tags/3.4.3/
- https://wordpress.org/plugins/shopbuilder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2047/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.