Access Control Vulnerability in ShopApper Mobile App Builder for WooCommerce by WordPress
CVE-2026-16568

Currently unrated

Key Information:

Vendor

WordPress
Status
Mobile App For WooCommerce: Shopapper Mobile App Builder Service For WooCommerce
Vendor
CVE Published:
27 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-16568?

The ShopApper Mobile App Builder Service for WooCommerce has a vulnerability where the plugin does not correctly verify user ownership of customer profiles accessed via its REST API endpoints. This oversight enables authenticated users, such as customers or subscribers, to potentially gain unauthorized access to sensitive personal information of other users, including email addresses, names, and roles, raising significant privacy concerns.

Affected Version(s)

Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce 0 <= 0.4.62

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-16568 - Proof of Concept

References

https://wpscan.com/vulnerability/489be79d-df68-4384-83ab-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

TruongLV1 From FPT Night Wolf
WPScan
.