Authorization Flaw in MgoSync Plugin for WordPress Exposes API Credentials
CVE-2026-92404
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-92404?
The MgoSync plugin for WordPress lacks proper authorization controls on its REST API endpoints. This oversight enables unauthenticated users to access sensitive WooCommerce API credentials, which include a read/write consumer key and secret. Consequently, this vulnerability poses a significant risk to site security, allowing unauthorized parties to manipulate data and transactions.
Affected Version(s)
MgoSync 2.1.5 < 2.1.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.