CVE-2026-16568 in ShopApper Mobile App Builder Service Plugin
Summary
by MITRE • 08/27/2026
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in ShopApper Mobile App Builder Service for WooCommerce versions prior to 0.4.62 represents a critical failure in server-side access control mechanisms within the plugin's REST API implementation. This flaw stems from an insecure direct object reference (IDOR) condition where the application fails to validate whether the authenticated user initiating the request possesses administrative privileges or ownership rights over the specific customer profile being accessed. In secure web applications, particularly those handling sensitive personal data such as e-commerce platforms built on WordPress and WooCommerce, every API endpoint must enforce strict authorization checks that verify the relationship between the current session's identity and the resource identifier provided in the request parameters. The absence of this verification logic allows any authenticated user with a basic subscriber or customer role to bypass intended restrictions and query arbitrary user profiles by manipulating identifiers within the REST endpoints exposed by the plugin.
From a technical perspective, this vulnerability exploits the lack of proper object-level permission checks during data retrieval operations. When an attacker authenticates to the WordPress site using standard credentials associated with a low-privilege account, they can construct HTTP requests targeting specific customer IDs or profile references without any server-side validation confirming that these resources belong to them. The application processes these requests and returns detailed personal information including email addresses, full names, and assigned user roles. This behavior indicates that the backend logic relies solely on the presence of a valid authentication token rather than verifying authorization scopes relative to the requested data objects. Such an oversight is particularly dangerous in multi-user environments where customer data privacy is paramount, as it effectively neutralizes role-based access control measures designed to segregate sensitive information between different user tiers.
The operational impact of this vulnerability extends beyond simple data leakage, potentially facilitating further malicious activities such as targeted phishing campaigns or account takeover attempts. By obtaining valid email addresses and names associated with specific customer accounts, an attacker can craft highly convincing social engineering attacks tailored to individual victims. Furthermore, the exposure of user roles may assist attackers in mapping out the administrative structure of a WordPress installation, identifying high-privilege users who might be targeted next for credential stuffing or brute-force attacks. The disclosure of personally identifiable information also constitutes a direct violation of data protection regulations such as GDPR and CCPA, exposing site administrators to significant legal liabilities and reputational damage due to non-compliance with privacy standards regarding the secure handling of customer data.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting failures in authorization checks that allow unauthorized access to resources. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate but low-privileged credentials to extract sensitive information from the system. Additionally, the mechanism of accessing specific objects through manipulated identifiers corresponds to CWE-639, Authorization Bypass Through User-Controlled Key. To mitigate this risk, administrators must immediately update the ShopApper Mobile App Builder Service plugin to version 0.4.62 or later where these authorization checks have been corrected. In cases where immediate patching is not feasible, implementing a Web Application Firewall rule that restricts access to sensitive REST endpoints based on user role capabilities can provide temporary protection. Regular security audits and penetration testing of custom plugins are essential to ensure that all API endpoints enforce strict ownership verification before returning any personal data.