CVE-2026-92404

Received Received - Intake

Unauthenticated Access to WooCommerce API Credentials in MgoSync WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: WPScan

Description

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-92404

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The MgoSync WordPress plugin before version 2.1.7 has a vulnerability in one of its REST API endpoints. This flaw allows unauthenticated users to access and retrieve stored WooCommerce API credentials, including sensitive read/write consumer keys and secrets, from a configured site.

Detection Guidance

Check if the MgoSync WordPress plugin version is below 2.1.7. Inspect network traffic for unauthorized access to the vulnerable REST API endpoint. Look for exposed WooCommerce API credentials in logs or database.

Impact Analysis

An attacker could exploit this vulnerability to gain access to WooCommerce API credentials. This could lead to unauthorized transactions, data breaches, or manipulation of store data if the credentials are used maliciously.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive customer data, violating GDPR's data protection requirements. For HIPAA, if the WooCommerce site handles protected health information, this could result in unauthorized disclosure, breaching compliance.

Mitigation Strategies

Update the MgoSync plugin to version 2.1.7 or later. Remove or restrict access to the vulnerable REST API endpoint. Rotate all exposed WooCommerce API credentials immediately.

Hi! I’m here to help you understand CVE-2026-92404. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70