CVE-2026-14832: 
WordPress vulnerability analysis and mitigation

CVE-2026-14832 is an unauthenticated sensitive information disclosure vulnerability (IDOR) in the ShopSmart Loyalty for WooCommerce WordPress plugin through version 1.0.0. The flaw allows any unauthenticated user who knows a customer's phone number to retrieve that customer's full loyalty profile, including name, email address, and account balance. It was publicly disclosed on August 14, 2026, with the CVE record published on August 17, 2026, and was discovered and reported by researcher Pedro Pinho. It carries a CVSS v3.1 base score of 5.3 (Medium) (WPScan, Github Advisory).

The root cause is an authorization bypass through a user-controlled key (CWE-639), classified as an Insecure Direct Object Reference (IDOR) under OWASP Top 10 A5: Broken Access Control. The plugin exposes a phone-number lookup endpoint (shopsmart_check_phone) to unauthenticated users without performing any authorization or ownership verification — an attacker simply supplies a target customer's phone number as the lookup key to retrieve their loyalty profile. No authentication, session token, or ownership check is enforced before returning the profile data. A proof-of-concept is scheduled for public release on August 28, 2026, to allow time for users to update (WPScan).

Successful exploitation results in unauthorized disclosure of customer PII, including full name, email address, and loyalty account balance, for any customer whose phone number is known or guessable. The attack is fully automatable and requires no authentication, making bulk enumeration of customer records feasible. There is no integrity or availability impact; however, the exposed data could facilitate phishing, account takeover attempts, or targeted fraud against affected customers (WPScan, Github Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation; CISA's SSVC assessment confirms exploitation status as "none" at this time. However, CISA notes the attack is automatable, meaning scripted enumeration of phone numbers to harvest customer profiles is technically straightforward. The EPSS score is approximately 0.16% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running the ShopSmart Loyalty for WooCommerce plugin (version ≤ 1.0.0) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Obtain target phone numbers: Gather customer phone numbers through open-source intelligence (OSINT), data leaks, or social engineering — phone numbers are the sole required input.
3. Send unauthenticated lookup request: Issue an HTTP request to the exposed shopsmart_check_phone endpoint (e.g., a POST or GET request to the WordPress AJAX handler with the target phone number as a parameter), without any authentication headers or cookies.
4. Retrieve customer profile: The plugin returns the customer's loyalty profile — including name, email address, and account balance — in the response, with no authorization check performed.
5. Enumerate at scale: Automate requests across a range of phone numbers to bulk-harvest customer PII from the affected WooCommerce store (WPScan).

• Network: High volume of unauthenticated HTTP requests to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the shopsmart_check_phone action parameter; sequential or pattern-based phone number values in request parameters suggesting enumeration.
• Logs: WordPress access logs showing repeated requests to admin-ajax.php from a single IP or rotating IPs with varying phone number inputs and consistent 200 OK responses; absence of authentication cookies in these requests.
• Process/Application: Unusual spikes in AJAX handler invocations for the loyalty plugin outside of normal business hours or from non-customer geographic regions.

No patched version of the ShopSmart Loyalty for WooCommerce plugin is currently available; the vulnerability affects all versions through 1.0.0 with no known fix at time of disclosure (WPScan, Github Advisory). As interim mitigations, site administrators should consider disabling or deactivating the plugin until a patched version is released, implementing a Web Application Firewall (WAF) rule to block unauthenticated requests to the shopsmart_check_phone AJAX action, and applying rate limiting on the lookup endpoint to prevent automated enumeration. Monitor the WPScan vulnerability database and the plugin's update channel for a patched release.

The vulnerability was discovered and responsibly disclosed by researcher Pedro Pinho via WPScan, which verified the finding and assigned it a WPVDB ID. WPScan has delayed publishing the full proof-of-concept until August 28, 2026, to provide a remediation window for site operators (WPScan). No significant broader media coverage or notable social media commentary beyond standard CVE tracking feeds has been observed at this time.