CVE-2026-114195
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The WP Desk ShopMagic plugin (shopmagic-for-woocommerce) has an insertion of sensitive information into an externally-accessible file or directory vulnerability, allowing retrieval of embedded sensitive data. This issue affects ShopMagic versions up to and including 4.9.1.
Risk Assessment
An attacker could access sensitive data that should be protected, potentially leading to privacy breaches or disclosure of business information. The risk applies to WooCommerce stores using this plugin.
Recommendation
Update the ShopMagic plugin to the latest version available from the vendor. Check that publicly accessible directories do not contain files with sensitive data.
Other vulnerabilities in ShopMagic
See all- CVE-2026-103367High
The ShopMagic – email automation for WordPress plugin is vulnerable to Local File Inclusion in all versions up to and including 4.9.0 via the 'billing_address.first_name' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling access control bypass, sensitive data disclosure, or code execution. Exploitation requires a published recipe processing the {{ customer.first_name }} placeholder — the built-in "New Order email with social media profile links" recipe satisfies this by default, making the default configuration exploitable with no account, cookie, or nonce.
- CVE-2025-69093Medium
The ShopMagic plugin for WooCommerce contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 4.7.2.
- CVE-2025-59578Medium
The ShopMagic plugin for WooCommerce up to version 4.5.6 inserts sensitive information into sent data, allowing retrieval of embedded sensitive data.
Original NVD description (English source)
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS