---
id: "CVE-2026-115733"
page: "https://infrastack.ai/live/CVE-2026-115733"
kind: "vulnerability"
aliases: ["CVE-2026-115733"]
title: "Printaura-Woocommerce WordPress plugin exposes WooCommerce REST API without authentication"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Printaura-Woocommerce", "fixed": [], "affected": "<= 4.0.2", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["other", "printaura-woocommerce", "woocommerce", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T06:17:13+00:00"
first_seen_at: "2026-11-11T06:25:40+00:00"
updated_at: "2026-11-11T06:30:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115733", "first_seen_at": "2026-11-11T06:25:40+00:00"}, {"source": "analyst", "url": "https://blog.printaura.com/blog/tutorials/integrate-with-woo", "first_seen_at": "2026-11-11T06:30:59+00:00", "cites": ["https://blog.printaura.com/blog/tutorials/integrate-with-woo"]}]
exploit_sources: []
---

# Printaura-Woocommerce WordPress plugin exposes WooCommerce REST API without authentication

Link for people: https://infrastack.ai/live/CVE-2026-115733 (this .md is for agents)

The Printaura-Woocommerce WordPress plugin through 4.0.2 fails to restrict access to the WooCommerce REST API, so every WooCommerce REST route accepts unauthenticated requests. An unauthenticated attacker can read and modify store data, including customer orders, personal information, store and payment settings, and webhooks.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:Printaura-Woocommerce affected <= 4.0.2 fixed no fixed version listed

## How to check

Check wp-content/plugins/ for a printaura-woocommerce directory and its version (4.0.2 or earlier is affected per NVD). Request /wp-json/wc/v3/orders without credentials; 401/403 is expected, order data means exposed. No fixed version is confirmed and the plugin is not found on wordpress.org search: remove or deactivate it unless Printaura confirms a patched release, then rotate WooCommerce API keys and review webhooks.

## Timeline

- 2026-11-11T06:25:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115733
- 2026-11-11T06:30:59+00:00 analyst https://blog.printaura.com/blog/tutorials/integrate-with-woo — NVD page returned no text; no vendor/maintainer advisory found. wordpress.org search for printaura-woocommerce returns 0 plugins (not listed there now). No fixed version found, nothing verified.

## Documents

- [mentions] Integrate with Woocommerce - Updated for Printaura Plugin V4.0.1 https://blog.printaura.com/blog/tutorials/integrate-with-woo

## From the sources

The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_