ShopBoost <= 1.8.9 - Unauthenticated Information Exposure of Unpublished Products via Quick Order Submission
- ID
- WPSEC-2026-3147
- Plugin
- ShopBoost – WooCommerce Toolkit (flexible-minimum-order)
- Affected
- from 1.7.3 before 1.9.0
- Remediation
- Update to 1.9.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-14
- Attack surface
- ShopBoost on WPSec AttackSurface
- Fix released
- Published
Description
The ShopBoost plugin for WordPress is vulnerable to Sensitive Information Exposure via the Quick Order submission endpoint (flexmior_quick_order_submit) in all versions up to, and including, 1.8.9. This is due to the handler only checking that wc_get_product() resolves the supplied product ID, without checking that the product is published. This makes it possible for unauthenticated attackers to submit quick-order requests against draft, private or trashed products by enumerating IDs, confirm that those products exist, and get their names in the customer confirmation email sent to an address they supply.
References
- https://wpsec.com/vuln/WPSEC-2026-3147/
- https://plugins.svn.wordpress.org/flexible-minimum-order/tags/1.9.0/
- https://wordpress.org/plugins/flexible-minimum-order/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS