Description

Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-27T10:16:35.290Z",
  "pubdate": "2026-08-27T10:16:35.290Z",
  "executiveSummary": "The Mobile App for WooCommerce plugin, specifically versions 0.4.62 and below, contains an unauthenticated broken access control vulnerability. This security flaw allows unauthenticated remote attackers to bypass authorization checks implemented within the plugin's API endpoints.\nThe vulnerability type is categorized under Broken Access Control, representing a critical failure in the plugin's security architecture where user permissions are not properly validated before processing requests.\nThe primary impact of this vulnerability is the unauthorized access to sensitive application data or restricted functionality. Because the vulnerability does not require authentication, an attacker can exploit the system with minimal effort, posing a significant risk to the confidentiality and integrity of the affected WooCommerce store.\nThe vulnerability exposes the site to unauthorized data extraction or administrative actions, depending on the specific endpoints affected by the faulty access control logic. No user interaction or elevated privileges are required for an attacker to initiate an exploit. System administrators are urged to address this as a high-priority security concern to prevent potential unauthorized data exposure.",
  "technicalDetails": "The vulnerability resides within the request handling mechanism of the Mobile App for WooCommerce plugin, where the authorization layer fails to verify the session or role of the requester before executing backend logic. In versions 0.4.62 and below, the affected components fail to implement proper REST API permission callbacks or nonce validation, effectively creating a public entry point to functions intended for authenticated or authorized administrators.\nThe root cause is a deficiency in the access control implementation, where the application assumes that requests to specific API routes will only originate from trusted sources. By manipulating request headers or simply crafting direct requests to the exposed REST endpoints, an attacker can bypass the intended restrictions.\nThe exploitation flow is straightforward: 1) The attacker identifies the exposed REST API endpoint associated with the Mobile App for WooCommerce plugin. 2) The attacker crafts a malicious HTTP request targeting the vulnerable function. 3) Because the server-side code omits the necessary permission checks (e.g., current_user_can() or check_ajax_referer()), the backend processes the request as a legitimate command. 4) The plugin executes the requested action or returns sensitive data stored within the plugin's database tables or associated site configurations.\nSince the vulnerability is network-exposed, any remote attacker with access to the site's REST API can leverage this flaw. The post-exploitation impact ranges from information disclosure—such as retrieving order details, customer data, or configuration settings—to potential unauthorized modification of site settings if the vulnerable endpoints support POST or PUT operations. The absence of authentication requirements means that traditional brute-force defenses or login rate-limiting are ineffective against this specific vector, as the request never hits the standard authentication flow."
}