5.3
Moyenne
CVE-2026-14832 The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership…
Description
The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ShopSmart Loyalty for WooCommerce 1.0 | premières → 1.0.0 | Pas de correctif indiqué |