---
id: "CVE-2026-115960"
kind: "vulnerability"
aliases: ["CVE-2026-115960"]
title: "WordPress WooCommerce Square plugin: missing authorization check exposes functions"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "square", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-26T11:16:36+00:00"
first_seen_at: "2026-10-26T11:29:41+00:00"
updated_at: "2026-10-26T11:31:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115960", "first_seen_at": "2026-10-26T11:29:41+00:00"}]
---

# WordPress WooCommerce Square plugin: missing authorization check exposes functions

The APIExperts Square for WooCommerce plugin for WordPress is missing an authorization check, so access control is not enforced on some functionality. The sources do not say exactly which action an attacker can perform.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the APIExperts Square for WooCommerce (woosquare) plugin in the WordPress admin under Plugins; unknown whether a specific version string is listed in the sources
- unknown for other checks

## Fix

- Update APIExperts Square for WooCommerce (woosquare) to a version later than `4.7.5`; the exact patched version is unknown

## Timeline

- 2026-10-26T11:29:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115960

## From the sources

Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_