Description

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock quantity of arbitrary products.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-27T06:16:56.600Z",
  "pubdate": "2026-08-27T06:16:56.600Z",
  "executiveSummary": "The ShopApper Mobile App Builder Service for WooCommerce WordPress plugin, in versions up to and including 0.4.62, contains a critical Broken Access Control vulnerability. The flaw resides within the plugin's REST API endpoint responsible for inventory management.\nThe vulnerability allows any authenticated user, regardless of their assigned role or privilege level (including customers or subscribers), to modify the stock quantity of any product within the WooCommerce store. This bypasses WordPress's standard capability checks, which should restrict such administrative actions to users with sufficient permissions, such as Shop Managers or Administrators.\nThe impact of this vulnerability is significant, as it permits unauthorized users to arbitrarily alter inventory levels, potentially leading to operational disruption, inaccurate sales data, business logic exploitation, or the forced 'out-of-stock' status for legitimate products. The vulnerability is exploitable remotely over the network, requiring only a valid authenticated session on the target WordPress site. The risk is classified as high due to the ease of exploitation and the potential for direct business impact on e-commerce operations.",
  "technicalDetails": "The root cause of this vulnerability is improper authorization handling within the REST API controller implementation provided by the ShopApper Mobile App Builder Service plugin. Specifically, the plugin exposes an endpoint designed to facilitate stock-update operations; however, the backend logic fails to invoke the necessary WordPress capability validation functions (such as current_user_can()) before processing incoming update requests.\nIn a secure implementation, an endpoint modifying product data must perform a strict check to ensure the requesting user possesses 'manage_woocommerce' or 'edit_products' capabilities. Because these checks are omitted in the affected versions, the API endpoint implicitly trusts any user providing a valid authentication cookie or token.\nThe attack flow proceeds as follows: An attacker with a low-privileged account (such as 'subscriber') authenticates to the WordPress instance to obtain a valid session cookie or nonced request header. The attacker then crafts an HTTP request targeting the vulnerable REST API endpoint associated with the ShopApper plugin. The request payload includes parameters defining the target product ID and the desired new stock quantity value.\nUpon receiving the request, the server executes the vulnerable handler function. Because the function lacks authorization middleware or privilege checks, it proceeds to interact directly with the WooCommerce/WordPress database abstraction layers to perform an UPDATE operation on the target product's stock meta or table record. The server then returns a success response to the attacker, confirming the inventory modification.\nThe exposure is global, affecting any WordPress installation utilizing the ShopApper plugin up to version 0.4.62. Since this functionality is accessible via the standard REST API interface, it can be exploited via automated scripts or manual interception tools like Burp Suite. Post-exploitation impact allows for mass inventory manipulation, which an attacker could weaponize to disrupt the supply chain or force an 'out of stock' state for competitors or specific items, directly impacting the integrity of the e-commerce environment."
}