Description

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-27T06:16:56.297Z",
  "pubdate": "2026-08-27T06:16:56.297Z",
  "executiveSummary": "The Mobile App for WooCommerce: ShopApper Mobile App Builder Service plugin contains an Insecure Direct Object Reference (IDOR) vulnerability.\nThis flaw exists within the plugin's REST API endpoints, which fail to perform adequate authorization checks on user-controlled input.\nAn authenticated user, such as a customer or subscriber, can leverage this vulnerability to bypass access controls and retrieve sensitive personal identifiable information (PII) of other users.\nExposed data fields include customer email addresses, full names, and account roles.\nThe vulnerability affects all versions of the plugin up to and including 0.4.62.\nThe risk is critical, as it allows for unauthorized data harvesting without requiring elevated privileges, potentially leading to large-scale privacy breaches and non-compliance with data protection regulations.\nExploitation requires the attacker to hold a valid, low-privileged authenticated account on the target WordPress installation.",
  "technicalDetails": "The vulnerability is rooted in an Insecure Direct Object Reference (IDOR) flaw within the REST API implementation of the ShopApper Mobile App Builder Service plugin.\nThe affected endpoint is designed to facilitate the retrieval of customer profiles; however, the backend logic fails to validate the ownership of the resource being requested against the authenticated session token of the requester.\nSpecifically, when a request is made to the vulnerable REST endpoint, the application retrieves profile data based on a user identifier passed as a parameter. Because the application lacks server-side authorization checks, it blindly processes the request, assuming that the user requesting the profile information is authorized to view the data for the provided identifier.\nAn attacker can exploit this by intercepting the legitimate request and modifying the user ID parameter to reference a different customer's profile. Since the server does not verify if the current user ID matches the requested user ID, it returns the target's personal information in the JSON response.\nThe attack flow proceeds as follows: 1) The attacker authenticates as a standard subscriber on the WordPress site. 2) The attacker initiates an authorized request to the plugin's REST API to view their own profile. 3) The attacker modifies the request payload or URL parameter to target the identifier of a different, non-privileged, or privileged user. 4) The server processes the request, checks that the user is authenticated, but fails to check if the user has permission to access the requested resource object. 5) The server sends the sensitive data (email, name, role) of the unintended user back to the attacker.\nThis vulnerability is present in versions up to 0.4.62. It represents a significant failure in secure API design, as the application relies on client-side state rather than server-side verification to enforce access control.\nPost-exploitation, an attacker can iterate through user IDs to harvest the entire database of user profiles. This leads to unauthorized access to sensitive PII, which could be leveraged for further attacks, such as targeted phishing, social engineering, or account takeover via password reset mechanisms if the email addresses are associated with external accounts.\nThe vulnerability is exposed over the network, as REST endpoints are accessible via standard HTTP/HTTPS requests to the WordPress instance."
}