CVE-2026-14832
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The ShopSmart Loyalty for WooCommerce plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.
Risk Assessment
An attacker can access customers' personal data, violating privacy and potentially leading to identity theft or fraud.
Recommendation
Update the plugin to the latest version once the vendor releases a fix. Restrict access to the phone-number lookup function or require authentication.
Original NVD description (English source)
The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.