Description

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-19T07:16:33.790Z",
  "pubdate": "2026-09-19T07:16:33.790Z",
  "executiveSummary": "The MgoSync WordPress plugin, in versions prior to 2.1.7, contains a critical security vulnerability involving the absence of authorization controls on a REST API endpoint. This misconfiguration allows remote, unauthenticated attackers to query the API and extract sensitive WooCommerce integration credentials, including the consumer key and consumer secret.\nThe vulnerability falls under the category of Improper Authorization or Broken Access Control. Successful exploitation grants an attacker full access to the target's WooCommerce environment, potentially allowing for the unauthorized manipulation of store data, customer information, and order management.\nThe risk is severe as it requires zero authentication and no user interaction, making it highly exploitable for automated scanning and mass credential theft. Any site utilizing MgoSync below version 2.1.7 is exposed to complete loss of API integrity.\nAttackers can leverage these stolen credentials to interact directly with the WooCommerce REST API, bypassing standard WordPress administrative interfaces to perform read/write operations on the site's e-commerce backend.",
  "technicalDetails": "The vulnerability resides within the REST API implementation of the MgoSync plugin. The plugin exposes an endpoint designed for internal synchronization operations but fails to implement necessary permission checks, such as 'current_user_can()', which would verify the requestor's administrative privileges before processing the request.\nThe root cause is an improper authorization check on a REST API route that returns configuration data. When a GET request is sent to the specific, unprotected endpoint, the plugin's backend logic executes a callback function that retrieves the plugin's settings object. This object, stored in the WordPress options table, contains plain-text WooCommerce API credentials used for synchronization between the WordPress site and the MgoSync service.\nThe exploitation flow is straightforward: 1) The attacker identifies a target site running an affected version of MgoSync. 2) The attacker issues an unauthenticated HTTP GET request to the identified vulnerable REST API endpoint. 3) The plugin fails to validate the request origin or session, triggering the retrieval of the configuration settings. 4) The API returns a JSON response containing the sensitive WooCommerce consumer key and secret. 5) The attacker captures these credentials and can subsequently authenticate to the site's WooCommerce REST API externally.\nThis vulnerability is classified as a critical exposure of sensitive information. Because the retrieved keys provide 'read/write' access, the attacker is not limited to data exfiltration. Post-exploitation impact includes the ability to modify product pricing, update inventory, intercept order details, or manipulate customer database records. Since the REST API interaction occurs via the legitimate WooCommerce framework, these actions are often difficult to detect through standard WordPress audit logs as they do not always manifest as traditional 'wp-admin' logins.\nThe exposure is global to any network configuration that allows access to the WordPress REST API, which is a public-facing component of the CMS. No specific privileges or prior knowledge of the target site's architecture are required, as the endpoint structure is discoverable through plugin source code analysis."
}