{"id":"CVE-2026-115733","kind":"vulnerability","aliases":["CVE-2026-115733"],"related":[],"title":"Printaura-Woocommerce WordPress plugin exposes WooCommerce REST API without authentication","description":"The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks.","summary":"The Printaura-Woocommerce WordPress plugin through 4.0.2 fails to restrict access to the WooCommerce REST API, so every WooCommerce REST route accepts unauthenticated requests. An unauthenticated attacker can read and modify store data, including customer orders, personal information, store and payment settings, and webhooks.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Printaura-Woocommerce","fixed":[],"affected":"<= 4.0.2","ecosystem":"wordpress"}],"ecosystems":[],"tags":["other","printaura-woocommerce","woocommerce","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"Check wp-content/plugins/ for a printaura-woocommerce directory and its version (4.0.2 or earlier is affected per NVD). Request /wp-json/wc/v3/orders without credentials; 401/403 is expected, order data means exposed. No fixed version is confirmed and the plugin is not found on wordpress.org search: remove or deactivate it unless Printaura confirms a patched release, then rotate WooCommerce API keys and review webhooks.","fix":null,"status":"open","published_at":"2026-11-11T06:17:13+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","triaged_at":"2026-11-11T06:27:54+00:00","updated_at":"2026-11-11T06:30:59+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-11T06:27:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Printaura-Woocommerce WordPress plugin exposes WooCommerce REST API without authentication","impact":"high","summary":"The Printaura-Woocommerce WordPress plugin through 4.0.2 fails to restrict access to the WooCommerce REST API, so every WooCommerce REST route accepts unauthenticated requests. An unauthenticated attacker can read and modify store data, including customer orders, personal information, store and payment settings, and webhooks.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","woocommerce","printaura-woocommerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads customer data and modifies orders, settings and webhooks","analyst_note":"Confirm the fixed version or vendor patch for Printaura-Woocommerce after 4.0.2 and whether the plugin has been removed or abandoned, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115733.","how_to_check":"- Check whether the `Printaura-Woocommerce` plugin is installed and its version is `4.0.2` or earlier\n- Look for the plugin's directory under `wp-content/plugins/` on the WordPress server\n- Send an unauthenticated request to a WooCommerce REST route on the store, such as `/wp-json/wc/v3/orders`, and see whether it returns data","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Stores running the Printaura-Woocommerce plugin version 4.0.2 or earlier on WordPress with WooCommerce. The sources do not say which configurations are affected beyond the plugin version, and do not name a fixed version. Sites without this plugin installed are not affected by this entry.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000803,"input_tokens":4567,"output_tokens":692,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version or vendor patch for Printaura-Woocommerce after 4.0.2 and whether the plugin has been removed or abandoned, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115733.","search":"'-115733':14A,17A '-2026':13A,16A '4.0.2':37B,82C 'accept':52B,99C 'access':41B,87C 'allow':103C 'api':9A,46B,92C 'attack':57B,105C 'authent':11A 'caus':93C 'custom':65B,113C 'cve':12A,15A 'data':63B,111C 'everi':48B,94C 'expos':6A 'fail':38B 'includ':64B,112C 'inform':68B,117C 'modifi':61B,109C 'order':66B,114C 'payment':71B,120C 'person':67B,116C 'plugin':5A,29B,35B,80C 'printaura':2A,19A,23B,32B,77C 'printaura-woocommerc':1A,22B,31B,76C 'printaura-woocommerce':18A 'proper':85C 'read':59B,107C 'request':54B,101C 'rest':8A,45B,50B,91C,96C 'restrict':40B,86C 'rout':51B,97C 'set':72B,121C 'store':62B,69B,110C,118C 'unauthent':53B,56B,100C,104C 'webhook':74B,123C 'without':10A 'woocommerc':3A,7A,24B,25B,33B,44B,49B,78C,90C,95C 'woocommerce':20A 'wordpress':4A,26B,28B,34B,79C 'wordpress-plugin':27B","nicknames":[],"mitigations":[],"who_affected":"WordPress/WooCommerce stores with the Printaura-Woocommerce plugin (connects a store to Printaura print-on-demand) at version 4.0.2 or earlier. Per the NVD description, WooCommerce REST routes accept unauthenticated requests, exposing orders, customer data and settings. Stores without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["printaurawoocommerce"],"ptokens":["printaura","woocommerce"],"labels":["high","other","printaurawoocommerce","woocommerce","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-115733':14A,17A '-2026':13A,16A 'api':9A 'authent':11A 'cve':12A,15A 'expos':6A 'plugin':5A 'printaura':2A,19A 'printaura-woocommerc':1A 'printaura-woocommerce':18A 'rest':8A 'without':10A 'woocommerc':3A,7A 'woocommerce':20A 'wordpress':4A","search_b":"'4.0.2':37B 'accept':52B 'access':41B 'api':46B 'attack':57B 'custom':65B 'data':63B 'everi':48B 'fail':38B 'includ':64B 'inform':68B 'modifi':61B 'order':66B 'payment':71B 'person':67B 'plugin':29B,35B 'printaura':23B,32B 'printaura-woocommerc':22B,31B 'read':59B 'request':54B 'rest':45B,50B 'restrict':40B 'rout':51B 'set':72B 'store':62B,69B 'unauthent':53B,56B 'webhook':74B 'woocommerc':24B,25B,33B,44B,49B 'wordpress':26B,28B,34B 'wordpress-plugin':27B","search_c":"'4.0.2':82C 'accept':99C 'access':87C 'allow':103C 'api':92C 'attack':105C 'caus':93C 'custom':113C 'data':111C 'everi':94C 'includ':112C 'inform':117C 'modifi':109C 'order':114C 'payment':120C 'person':116C 'plugin':80C 'printaura':77C 'printaura-woocommerc':76C 'proper':85C 'read':107C 'request':101C 'rest':91C,96C 'restrict':86C 'rout':97C 'set':121C 'store':110C,118C 'unauthent':100C,104C 'webhook':123C 'woocommerc':78C,90C,95C 'wordpress':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115733","severity":null,"published_at":"2026-11-11T06:17:13+00:00","modified_at":"2026-11-11T06:17:13+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","fetched_at":"2026-11-11T06:25:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115733:3514","url":"https://blog.printaura.com/blog/tutorials/integrate-with-woo","severity":null,"published_at":"2026-11-11T06:30:59+00:00","modified_at":"2026-11-11T06:30:59+00:00","first_seen_at":"2026-11-11T06:30:59+00:00","fetched_at":"2026-11-11T06:30:59+00:00","note":"NVD page returned no text; no vendor/maintainer advisory found. wordpress.org search for printaura-woocommerce returns 0 plugins (not listed there now). No fixed version found, nothing verified.","cites":["https://blog.printaura.com/blog/tutorials/integrate-with-woo"]}],"documents":[{"id":123313,"url":"https://blog.printaura.com/blog/tutorials/integrate-with-woo","title":"Integrate with Woocommerce - Updated for Printaura Plugin V4.0.1","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}