{
 "id": "WPSEC-2026-3147",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3147/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3147/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3147/index.md",
 "title": "ShopBoost <= 1.8.9 - Unauthenticated Information Exposure of Unpublished Products via Quick Order Submission",
 "description": "The ShopBoost plugin for WordPress is vulnerable to Sensitive Information Exposure via the Quick Order submission endpoint (flexmior_quick_order_submit) in all versions up to, and including, 1.8.9. This is due to the handler only checking that wc_get_product() resolves the supplied product ID, without checking that the product is published. This makes it possible for unauthenticated attackers to submit quick-order requests against draft, private or trashed products by enumerating IDs, confirm that those products exist, and get their names in the customer confirmation email sent to an address they supply.",
 "plugin": {
  "slug": "flexible-minimum-order",
  "name": "ShopBoost",
  "full_name": "ShopBoost – WooCommerce Toolkit",
  "wordpress_org": "https://wordpress.org/plugins/flexible-minimum-order/",
  "advisories_url": "https://wpsec.com/vuln/plugin/flexible-minimum-order/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/flexible-minimum-order"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.7.3",
    "from_inclusive": true,
    "to": "1.9.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.7.3 before 1.9.0"
  ]
 },
 "introduced_in": "1.7.3",
 "fixed_in": "1.9.0",
 "remediation": "Update to 1.9.0 or later.",
 "fix_released": "2026-11-13T20:39:52+00:00",
 "published": "2026-11-14T20:42:02+00:00",
 "updated": "2026-11-14T16:17:24.244521+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3147/",
  "https://plugins.svn.wordpress.org/flexible-minimum-order/tags/1.9.0/",
  "https://wordpress.org/plugins/flexible-minimum-order/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/flexible-minimum-order",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-14"
 }
}