{"id":"CVE-2026-115960","kind":"vulnerability","aliases":["CVE-2026-115960"],"related":[],"title":"WordPress WooCommerce Square plugin: missing authorization check exposes functions","description":"Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.","summary":"The APIExperts Square for WooCommerce plugin for WordPress is missing an authorization check, so access control is not enforced on some functionality. The sources do not say exactly which action an attacker can perform.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","square","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the APIExperts Square for WooCommerce (woosquare) plugin in the WordPress admin under Plugins; unknown whether a specific version string is listed in the sources\n- unknown for other checks","fix":"- Update APIExperts Square for WooCommerce (woosquare) to a version later than `4.7.5`; the exact patched version is unknown","status":"open","published_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:41+00:00","triaged_at":"2026-10-26T11:31:16+00:00","updated_at":"2026-10-26T11:31:16+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-26T11:31:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update APIExperts Square for WooCommerce (woosquare) to a version later than `4.7.5`; the exact patched version is unknown","reach":"internet","title":"WordPress WooCommerce Square plugin: missing authorization check exposes functions","impact":"medium","summary":"The APIExperts Square for WooCommerce plugin for WordPress is missing an authorization check, so access control is not enforced on some functionality. The sources do not say exactly which action an attacker can perform.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","square","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown access to plugin functions due to missing authorization","analyst_note":"Find the vulnerable function and required privilege from the plugin changelog or a fuller NVD/Wordfence advisory for CVE-2026-115960.","how_to_check":"- Check the installed version of the APIExperts Square for WooCommerce (woosquare) plugin in the WordPress admin under Plugins; unknown whether a specific version string is listed in the sources\n- unknown for other checks","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the APIExperts Square for WooCommerce (woosquare) WordPress plugin at version `4.7.5` or earlier, where WooCommerce is used with Square. The sources do not describe the specific configuration that makes a site exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000607,"input_tokens":3318,"output_tokens":550,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115960':12A,15A '-2026':11A,14A '4.7.5':84C 'access':37B,71C 'action':52B 'affect':76C 'allow':67C 'apiexpert':24B,62C,77C 'attack':54B 'author':6A,34B,58C 'check':7A,35B 'configur':70C 'control':38B,72C 'cve':10A,13A 'enforc':41B 'exact':50B 'exploit':68C 'expos':8A 'function':9A,44B 'host':19B 'incorrect':69C 'issu':75C 'levels.this':74C 'miss':5A,32B,57C 'n/a':82C 'packag':16B 'perform':56B 'plugin':4A,28B 'say':49B 'secur':73C 'self':18B 'self-host':17B 'sourc':46B 'squar':3A,20B,25B,63C,78C 'vulner':59C 'woocommerc':2A,21B,27B,65C,80C 'woosquar':66C 'wordpress':1A,22B,30B 'wpexpert':61C","nicknames":[],"mitigations":[],"who_affected":"Sites running the APIExperts Square for WooCommerce (woosquare) WordPress plugin at version `4.7.5` or earlier, where WooCommerce is used with Square. The sources do not describe the specific configuration that makes a site exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115960","severity":null,"published_at":"2026-10-26T11:16:36+00:00","modified_at":"2026-10-26T11:16:36+00:00","first_seen_at":"2026-10-26T11:29:41+00:00","fetched_at":"2026-10-26T11:29:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}