5.3
Medium
CVE-2026-14832 The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership…
Description
The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ShopSmart Loyalty for WooCommerce 1.0 | earliest → 1.0.0 | No fix stated |