Insufficient User Capability Check in WooCommerce Mobile App Builder Service
CVE-2026-16569

Currently unrated

Key Information:

Vendor

WordPress
Status
Mobile App For WooCommerce: Shopapper Mobile App Builder Service For WooCommerce
Vendor
CVE Published:
27 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-16569?

The ShopApper Mobile App Builder Service for WooCommerce up to version 0.4.62 has a significant security issue where it does not properly verify user capabilities for stock-update operations. This oversight allows any authenticated user, including customers and subscribers, to alter the stock quantities of products through its REST endpoints. This vulnerability places the integrity of product inventory at risk, enabling unauthorized modifications that can disrupt e-commerce operations.

Affected Version(s)

Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce 0 <= 0.4.62

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-16569 - Proof of Concept

References

https://wpscan.com/vulnerability/0d96cc80-0bba-45e4-8e07-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

TruongLV1 From FPT Night Wolf
WPScan
.