CVE-2026-88929 in Product Badge Label Countdown Timer Plugin
Summary
by MITRE • 09/23/2026
The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in versions of the Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin prior to version 7.5.2 represents a critical failure in access control mechanisms within the application logic. This flaw specifically affects how the plugin handles requests from unauthenticated users seeking product information via its API endpoints or AJAX handlers. The core issue lies in the absence of proper state verification when retrieving data associated with WooCommerce products. Instead of filtering results to include only publicly visible items, the software returns detailed metadata for all products regardless of their publication status. This oversight allows external actors to bypass standard visibility restrictions that are typically enforced by WordPress and WooCommerce themes during normal browsing sessions.
From a technical perspective, this vulnerability is classified under CWE-200 as an Information Exposure through Unrestricted Retrieval of Sensitive Data. The application fails to validate the post_status field associated with each product before serializing and returning its attributes to the client side. In standard WordPress operations, draft posts are intended for internal editing by authors or administrators, pending posts require editorial approval, and private products are restricted to logged-in users with specific capabilities. By ignoring these states during API responses, the plugin exposes data that should remain hidden from public view. This behavior effectively neutralizes the privacy settings configured within the e-commerce platform, rendering them ineffective against automated scraping tools or malicious scripts designed to harvest product catalogs.
The operational impact of this vulnerability is significant for businesses relying on WooCommerce for their online presence. Competitors can utilize simple HTTP requests to enumerate and extract complete product listings, including titles, descriptions, pricing structures, and potentially SKU numbers, without needing any form of authentication. This capability facilitates competitive intelligence gathering at scale, allowing rivals to monitor inventory changes, price adjustments, and new product launches in real time. Furthermore, the exposure of draft products may reveal upcoming marketing campaigns or strategic business moves before they are officially announced. For organizations handling sensitive pricing models or exclusive content tied to private products, this leak constitutes a direct breach of confidentiality expectations established with their customer base.
This type of information disclosure aligns with several techniques observed in the MITRE ATT&CK framework for enterprise environments. Specifically, it corresponds to T1087 Account Discovery and T1530 Data from Cloud Storage Objects if viewed through the lens of data exfiltration via API endpoints. Attackers can leverage this flaw as part of a broader reconnaissance phase to map out an organization's digital assets. The ease with which unauthenticated users can access this information lowers the barrier for entry, enabling even low-skilled threat actors to conduct extensive data mining operations against vulnerable WooCommerce stores.
To mitigate this risk, administrators must upgrade the Product Badge, Label, Countdown Timer plugin to version 7.5.2 or later immediately upon availability. This update includes patches that enforce proper capability checks and status validations before returning product details. In addition to updating software, site owners should review their server-side configurations to ensure no other plugins are exposing similar data through unsecured endpoints. Implementing Web Application Firewall rules can also help detect and block automated scraping attempts targeting these API endpoints while waiting for the patch to be applied. Regular security audits of custom code and third-party extensions are essential to maintain robust access controls and prevent future information leakage incidents in WordPress-based e-commerce environments.