{
 "id": "WPSEC-2026-2218",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2218/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2218/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2218/index.md",
 "title": "The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.7 - Authenticated (Editor+) Missing Authorization to Onboarding Settings Update",
 "description": "The ShopEngine plugin for WordPress is vulnerable to unauthorized modification of data via the 'settings/save_onboard' REST endpoint in all versions up to, and including, 4.9.7, due to a missing capability check in the post_save_onboard() function. The route's permission callback only requires the edit_others_posts capability. This makes it possible for authenticated attackers, with Editor-level access and above, to enable or disable the plugin's widgets and modules, mark onboarding as complete, trigger the sending of diagnostic site data to the vendor, and subscribe an arbitrary email address to the vendor's newsletter.",
 "plugin": {
  "slug": "shopengine",
  "name": "The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets",
  "full_name": "ShopEngine – All-in-One Elementor WooCommerce Builder with eCommerce Templates & Woo Widgets",
  "wordpress_org": "https://wordpress.org/plugins/shopengine/",
  "advisories_url": "https://wpsec.com/vuln/plugin/shopengine/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/shopengine"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 2.7,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.9.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.9.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.9.8",
 "remediation": "Update to 4.9.8 or later.",
 "fix_released": "2026-11-02T11:09:00+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:20:12.080795+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2218/",
  "https://plugins.svn.wordpress.org/shopengine/tags/4.9.8/",
  "https://wordpress.org/plugins/shopengine/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/shopengine",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}