---
id: "CVE-2026-115959"
kind: "vulnerability"
aliases: ["CVE-2026-115959"]
title: "WordPress Square for WooCommerce plugin: missing authorization check through 4.7.5"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "square", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-26T11:16:36+00:00"
first_seen_at: "2026-10-26T11:29:41+00:00"
updated_at: "2026-10-26T11:31:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115959", "first_seen_at": "2026-10-26T11:29:41+00:00"}]
---

# WordPress Square for WooCommerce plugin: missing authorization check through 4.7.5

The APIExperts Square for WooCommerce WordPress plugin is missing an authorization check, so access controls are not enforced as intended. Per the NVD description, an attacker can exploit incorrectly configured access control levels in versions through 4.7.5.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version (WordPress admin, Plugins list, or `wp plugin get woosquare --field=version`) and see whether it is `4.7.5` or older.
- unknown

## Fix

- Update the APIExperts Square for WooCommerce (woosquare) plugin to a version later than `4.7.5` once the vendor publishes one; the sources do not name a fixed version.
- unknown

## Timeline

- 2026-10-26T11:29:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115959

## From the sources

Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_