Live › vulnerability › CVE-2026-114195
Go to dashboardShopMagic for WooCommerce, a WordPress plugin by WP Desk, writes sensitive information into a file or directory that other people can reach over the web. An attacker can retrieve that embedded sensitive data without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the ShopMagic for WooCommerce plugin at version 4.9.1 or earlier are affected, since the sources list the flaw as affecting versions through 4.9.1. Sites that do not run this plugin can skip it. Whether the exposed data is sensitive in a given store depends on what ShopMagic writes to web-reachable locations, which the sources do not say.
No product ranges from the sources yet.
wp plugin get shopmagic-for-woocommerce --field=version4.9.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-114195")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.