CHARGELY-FREE-SUBSCRIPTIONS-FOR-WOOCOMMERCE · CVE-2026-116528 · Other
NO FIX YET · SEE WHAT TO DO
The Chargely Free Subscriptions for WooCommerce WordPress plugin through version 1.0 exposes a REST API route without any authorization check. An unauthenticated attacker can read the stored WooCommerce REST API consumer key and secret, which grant read and write access to the whole store.
first public Nov 14, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Stores running the Chargely Free Subscriptions for WooCommerce WordPress plugin through version 1.0 are exposed, because the plugin's REST route returns its stored WooCommerce consumer key and secret without checking who asks. Sites that do not have this plugin installed are not affected. The sources do not say whether a default configuration or any setting changes exposure.
Not affected if plugin-not-installed
Who cares chargely, woocommerce, wordpress, wordpress-plugin
Posts are quoted with a link to the original. They are data to us, never instructions.
The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.