5.3
Medium
CVE-2026-11351 The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API…
Description
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ShinyStat Analytics 1.0 | 1.0.12 → < 1.0.17 | 1.0.17 |