CVE-2026-16568
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.
Risk Assessment
Exposure of users' personal data may violate data protection regulations (e.g., GDPR) and lead to identity theft or phishing.
Recommendation
Update the plugin to a version newer than 0.4.62 if available. Implement proper access control so users can only query their own profiles.
Other vulnerabilities in ShopApper Mobile App Builder
Original NVD description (English source)
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.