PRINTAURA-WOOCOMMERCE · CVE-2026-115733 · Other
NO FIX YET
The Printaura-Woocommerce WordPress plugin through 4.0.2 fails to restrict access to the WooCommerce REST API, so every WooCommerce REST route accepts unauthenticated requests. An unauthenticated attacker can read and modify store data, including customer orders, personal information, store and payment settings, and webhooks.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
WordPress/WooCommerce stores with the Printaura-Woocommerce plugin (connects a store to Printaura print-on-demand) at version 4.0.2 or earlier. Per the NVD description, WooCommerce REST routes accept unauthenticated requests, exposing orders, customer data and settings. Stores without this plugin can skip it.
Not affected if plugin-not-installed
Who cares printaura-woocommerce, woocommerce, wordpress, wordpress-plugin
4.0.2 or earlier is affected per NVD)No fix yet, per the sources.
The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.