{"id":"CVE-2026-114195","kind":"vulnerability","aliases":["CVE-2026-114195"],"related":[],"title":"WP Desk ShopMagic for WooCommerce: embedded sensitive data exposed in accessible files","description":"Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.","summary":"ShopMagic for WooCommerce, a WordPress plugin by WP Desk, writes sensitive information into a file or directory that other people can reach over the web. An attacker can retrieve that embedded sensitive data without logging in.","severity":"medium","cvss":5.3,"epss":0.00197,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","shopmagic","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-5-or-later"],"how_to_check":"- Check the installed ShopMagic version in the WordPress plugins screen or with `wp plugin get shopmagic-for-woocommerce --field=version`\n- unknown for the exact file or directory path the sources do not name","fix":"- Update ShopMagic for WooCommerce to a version newer than `4.9.1`\n- unknown for a patched version number, as the sources do not name one","status":"open","published_at":"2026-10-22T09:17:15+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:26+00:00","updated_at":"2026-10-25T04:20:26+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:20:26Z","model":"claude-haiku-5-5","output":{"fix":"- Update ShopMagic for WooCommerce to a version newer than `4.9.1`\n- unknown for a patched version number, as the sources do not name one","reach":"internet","title":"WP Desk ShopMagic for WooCommerce: embedded sensitive data exposed in accessible files","impact":"medium","summary":"ShopMagic for WooCommerce, a WordPress plugin by WP Desk, writes sensitive information into a file or directory that other people can reach over the web. An attacker can retrieve that embedded sensitive data without logging in.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","shopmagic","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads embedded sensitive data from a web-accessible file","analyst_note":"Find the vendor advisory or Wordfence record to confirm the exposed file path, what data is exposed, the patched version, and whether authentication is needed.","how_to_check":"- Check the installed ShopMagic version in the WordPress plugins screen or with `wp plugin get shopmagic-for-woocommerce --field=version`\n- unknown for the exact file or directory path the sources do not name","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-5-or-later"],"who_is_affected":"Sites running the ShopMagic for WooCommerce plugin at version 4.9.1 or earlier are affected, since the sources list the flaw as affecting versions through 4.9.1. Sites that do not run this plugin can skip it. Whether the exposed data is sensitive in a given store depends on what ShopMagic writes to web-reachable locations, which the sources do not say.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":3363,"output_tokens":630,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114195':15A,18A '-2026':14A,17A '4.9.1':92C 'access':11A,68C 'affect':87C 'allow':81C 'attack':52B 'cve':13A,16A 'data':8A,58B 'data.this':85C 'desk':2A,34B,75C 'directori':42B,71C 'embed':6A,56B,83C 'expos':9A 'extern':67C 'externally-access':66C 'file':12A,40B,69C 'host':22B 'inform':37B,64C 'insert':61C 'issu':86C 'log':60B 'n/a':90C 'packag':19B 'peopl':45B 'plugin':31B 'reach':47B 'retriev':54B,82C 'self':21B 'self-host':20B 'sensit':7A,36B,57B,63C,84C 'shopmag':3A,23B,26B,76C,78C,88C 'shopmagic-for-woocommerc':77C 'vulner':72C 'web':50B 'without':59B 'woocommerc':5A,24B,28B,80C 'wordpress':25B,30B 'wp':1A,33B,74C 'write':35B","nicknames":[],"mitigations":[],"who_affected":"Sites running the ShopMagic for WooCommerce plugin at version 4.9.1 or earlier are affected, since the sources list the flaw as affecting versions through 4.9.1. Sites that do not run this plugin can skip it. Whether the exposed data is sensitive in a given store depends on what ShopMagic writes to web-reachable locations, which the sources do not say.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114195","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114195","severity":null,"published_at":"2026-10-22T09:17:15+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114195","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114195","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}