Exposed Product Information in WooCommerce Plugin by WordPress
CVE-2026-88929

Currently unrated

Key Information:

Vendor

WordPress
Status
Product Badge, Label, Countdown Timer For WooCommerce
Vendor
CVE Published:
23 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-88929?

The Product Badge, Label, Countdown Timer for WooCommerce plugin for WordPress fails to implement necessary checks to verify if a product is published before disclosing its details to unauthenticated users. This flaw allows unauthorized individuals to access and read sensitive information, such as product titles, descriptions, and pricing, for products that are in draft, pending, or private status, posing a significant risk to user privacy and product confidentiality.

Affected Version(s)

Product Badge, Label, Countdown Timer for WooCommerce 7.0.0 < 7.5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-88929 - Proof of Concept

References

https://wpscan.com/vulnerability/d6e10041-4171-4153-94bc-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Que Thanh Tuan
WPScan
.