{"id":"CVE-2026-115959","kind":"vulnerability","aliases":["CVE-2026-115959"],"related":[],"title":"WordPress Square for WooCommerce plugin: missing authorization check through 4.7.5","description":"Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.","summary":"The APIExperts Square for WooCommerce WordPress plugin is missing an authorization check, so access controls are not enforced as intended. Per the NVD description, an attacker can exploit incorrectly configured access control levels in versions through 4.7.5.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","square","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version (WordPress admin, Plugins list, or `wp plugin get woosquare --field=version`) and see whether it is `4.7.5` or older.\n- unknown","fix":"- Update the APIExperts Square for WooCommerce (woosquare) plugin to a version later than `4.7.5` once the vendor publishes one; the sources do not name a fixed version.\n- unknown","status":"open","published_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:41+00:00","triaged_at":"2026-10-26T11:31:15+00:00","updated_at":"2026-10-26T11:31:15+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T11:31:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update the APIExperts Square for WooCommerce (woosquare) plugin to a version later than `4.7.5` once the vendor publishes one; the sources do not name a fixed version.\n- unknown","reach":"internet","title":"WordPress Square for WooCommerce plugin: missing authorization check through 4.7.5","impact":"medium","summary":"The APIExperts Square for WooCommerce WordPress plugin is missing an authorization check, so access controls are not enforced as intended. Per the NVD description, an attacker can exploit incorrectly configured access control levels in versions through 4.7.5.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","square","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unauthorized users may perform actions reserved for privileged roles","analyst_note":"Confirm the affected endpoints, required privilege level, and whether a fixed plugin version exists, using the NVD entry and the WPExperts plugin changelog.","how_to_check":"- Check the installed plugin version (WordPress admin, Plugins list, or `wp plugin get woosquare --field=version`) and see whether it is `4.7.5` or older.\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WooCommerce Square integration plugin (woosquare) at version 4.7.5 or older. The sources do not say which configurations make the missing check reachable, so treat any site with the plugin installed as in scope. Sites without the plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000628,"input_tokens":3318,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115959':13A,16A '-2026':12A,15A '4.7.5':10A,60B,88C 'access':37B,54B,75C 'affect':80C 'allow':71C 'apiexpert':25B,66C,81C 'attack':49B 'author':7A,34B,62C 'check':8A,35B 'configur':53B,74C 'control':38B,55B,76C 'cve':11A,14A 'descript':47B 'enforc':41B 'exploit':51B,72C 'host':20B 'incorrect':52B,73C 'intend':43B 'issu':79C 'level':56B 'levels.this':78C 'miss':6A,32B,61C 'n/a':86C 'nvd':46B 'packag':17B 'per':44B 'plugin':5A,30B 'secur':77C 'self':19B 'self-host':18B 'squar':2A,21B,26B,67C,82C 'version':58B 'vulner':63C 'woocommerc':4A,22B,28B,69C,84C 'woosquar':70C 'wordpress':1A,23B,29B 'wpexpert':65C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WooCommerce Square integration plugin (woosquare) at version 4.7.5 or older. The sources do not say which configurations make the missing check reachable, so treat any site with the plugin installed as in scope. Sites without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115959","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115959","severity":null,"published_at":"2026-10-26T11:16:36+00:00","modified_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:41+00:00","fetched_at":"2026-10-26T11:29:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}