CVE-2026-7529: 
WordPress vulnerability analysis and mitigation

CVE-2026-7529 is a Missing Authorization vulnerability in the wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress, developed by wisemattic. All versions up to and including 1.1.16 are affected. The flaw arises because every REST API endpoint in the plugin is registered with permission_callback => '__return_true', granting unauthenticated network access to sensitive plugin functionality. It was published on August 5, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, GitHub Advisory).

The root cause is CWE-862 (Missing Authorization): the plugin registers all its WordPress REST API routes using permission_callback => '__return_true', which unconditionally allows any request — authenticated or not — to reach the endpoint handlers without any nonce or capability check (Wordfence). Affected classes include Banner.php (line 50), WiseBannerV2.php (line 105), StockBar.php (line 176), and Menu.php (line 38), all of which expose write-capable REST endpoints (GitHub Advisory). An attacker can send standard HTTP requests to these endpoints to save or update banner records, toggle stockbar and feature flags, change the active banner, or upload arbitrary background image files via WordPress's wp_handle_upload() function — all without any credentials.

Successful exploitation allows an unauthenticated remote attacker to modify the plugin's banner configurations, toggle stockbar and feature flags, change the active banner displayed to site visitors, and upload arbitrary image files to the WordPress installation — all of which directly affect site integrity and appearance (Wordfence). The confidentiality impact is limited (plugin settings can be read), but the high integrity impact means attackers could deface WooCommerce storefronts or inject malicious content via banner manipulation. Availability is not directly impacted, and there is no evidence of lateral movement potential beyond the plugin's scope.

1. Reconnaissance: Identify WordPress sites running the wiseCampaign plugin (version ≤ 1.1.16) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at wp-content/plugins/wisecampaign/.
2. Enumerate REST API endpoints: Query the WordPress REST API discovery endpoint (/wp-json/) to enumerate registered routes belonging to the wiseCampaign plugin (e.g., routes under a wisecampaign namespace).
3. Send unauthenticated requests: Craft HTTP POST/GET requests directly to the identified endpoints (e.g., those handled by Banner.php, StockBar.php, WiseBannerV2.php, or Menu.php) without any authentication headers or nonce values.
4. Modify plugin settings: Submit payloads to save or update banner records, toggle stockbar/feature flags, or change the active banner — all accepted without authorization checks.
5. Upload files: Use the file upload endpoint (backed by wp_handle_upload()) to upload a crafted background image file to the server, potentially for defacement or as a foothold for further attacks if file type validation is insufficient (Wordfence).

• Network: Unexpected HTTP POST requests to WordPress REST API endpoints under the wiseCampaign namespace (e.g., /wp-json/wisecampaign/v1/...) originating from unknown or automated IP addresses; high-frequency requests to these endpoints suggesting automated scanning.
• File System: Newly uploaded or modified files in the WordPress uploads directory (wp-content/uploads/) with image extensions (.jpg, .png, .gif) that were not placed there by legitimate site administrators; unexpected modification timestamps on plugin-related files.
• Logs: Web server access logs showing repeated unauthenticated REST API calls to wiseCampaign endpoints without a valid WordPress authentication cookie or nonce; HTTP 200 responses to POST requests on these endpoints from unfamiliar IPs.
• Application: Unexpected changes to banner content, stockbar settings, or feature flags within the wiseCampaign plugin admin panel that were not made by authorized administrators.

Update the wiseCampaign – WooCommerce Conversions Made Easy plugin to a version beyond 1.1.16, which includes the patch that adds proper authorization checks to REST API endpoints (changeset available at the WordPress plugin repository) (GitHub Advisory). As an interim measure, restrict access to the plugin's REST API endpoints using a web application firewall (WAF) rule blocking unauthenticated requests to the wiseCampaign REST namespace, or disable the plugin entirely if it is not actively in use. Administrators should also review recent banner configurations and uploaded files for any unauthorized modifications.

The vulnerability was discovered and reported by Wordfence, which assigned the CVE and published the advisory on August 5, 2026 (Wordfence). No significant broader community discussion, social media reactions, or notable researcher commentary beyond the initial disclosure have been identified at this time.