# ShopBoost <= 1.8.9 - Unauthenticated Information Exposure of Unpublished Products via Quick Order Submission

- **ID:** WPSEC-2026-3147
- **Plugin:** ShopBoost – WooCommerce Toolkit (`flexible-minimum-order`), https://wordpress.org/plugins/flexible-minimum-order/
- **Affected versions:** from 1.7.3 before 1.9.0
- **Fixed in:** 1.9.0 (Update to 1.9.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/flexible-minimum-order
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3147/

## Description

The ShopBoost plugin for WordPress is vulnerable to Sensitive Information Exposure via the Quick Order submission endpoint (flexmior_quick_order_submit) in all versions up to, and including, 1.8.9. This is due to the handler only checking that wc_get_product() resolves the supplied product ID, without checking that the product is published. This makes it possible for unauthenticated attackers to submit quick-order requests against draft, private or trashed products by enumerating IDs, confirm that those products exist, and get their names in the customer confirmation email sent to an address they supply.

## References

- https://wpsec.com/vuln/WPSEC-2026-3147/
- https://plugins.svn.wordpress.org/flexible-minimum-order/tags/1.9.0/
- https://wordpress.org/plugins/flexible-minimum-order/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3147/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.