Description

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-17T06:17:31.657Z",
  "pubdate": "2026-08-17T06:17:31.657Z",
  "executiveSummary": "An information disclosure vulnerability exists in the ShopSmart Loyalty for WooCommerce WordPress plugin through version 1.0.0. The vulnerability stems from an insecurely implemented phone-number lookup functionality that lacks proper authorization and ownership validation checks. Unauthenticated malicious actors can leverage this flaw to query arbitrary phone numbers and harvest sensitive customer loyalty profile data. The exposed information includes personally identifiable information such as customer names, email addresses, and active account balances, introducing significant privacy risks and potential compliance violations under data protection regulations. The attack vector is remotely exploitable over the network without requiring any prior authentication, user interaction, or elevated privileges, lowering the threshold for exploitation. The lack of rate limiting or access controls on the lookup mechanism enables automated enumeration of customer profiles, potentially leading to mass data harvesting campaigns.",
  "technicalDetails": "The root cause of the vulnerability resides in the inadequate implementation of access control mechanisms within the plugin's phone-number lookup feature. Specifically, the endpoint responsible for processing phone number queries fails to enforce authorization checks to verify whether the requesting entity possesses the appropriate permissions or owns the target account data. Consequently, the application processes requests from completely unauthenticated users and returns sensitive database records.\nThe vulnerable component is the unauthenticated lookup function exposed by the ShopSmart Loyalty for WooCommerce plugin across all versions through 1.0.0. The attack flow proceeds as follows: an unauthenticated attacker crafts an HTTP request targeting the exposed lookup endpoint, supplying a target customer's phone number as a parameter. Due to the absence of input validation regarding user session state and the lack of ownership verification, the backend application queries the database and retrieves the corresponding user record. The server subsequently serializes and returns the loyalty profile—containing the customer's full name, email address, and account balance—directly in the HTTP response.\nBecause the endpoint is exposed to the public network and requires no authentication or privilege levels, adversaries can script automated enumeration routines, iterating through lists of known or sequentially generated phone numbers to harvest extensive customer databases. The post-exploitation impact includes unauthorized acquisition of personally identifiable information (PII), which can be weaponized for targeted phishing campaigns, social engineering attacks, or financial fraud leveraging compromised loyalty account balances."
}