{"id":"CVE-2026-116528","kind":"vulnerability","aliases":["CVE-2026-116528"],"related":[],"title":"WordPress Chargely plugin leaks WooCommerce API keys to anyone unauthenticated","description":"The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store.","summary":"The Chargely Free Subscriptions for WooCommerce WordPress plugin through version 1.0 exposes a REST API route without any authorization check. An unauthenticated attacker can read the stored WooCommerce REST API consumer key and secret, which grant read and write access to the whole store.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"chargely-free-subscriptions-for-woocommerce","fixed":[],"affected":"<= 1.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["chargely","other","woocommerce","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- In WP admin > Plugins, look for 'Chargely Free Subscriptions For Woocommernce' (slug chargely-free-subscriptions-for-woocommerce). Version 1.0 is the only release, so any install is affected.\n- Check WooCommerce > Settings > Advanced > REST API for keys the plugin created; treat them as exposed if the plugin was active and reachable.","fix":"No patched version. The WordPress.org page says the plugin was closed on October 28, 2026, temporarily pending a full review, and is not available for download. Deactivate and delete the plugin, then rotate the WooCommerce REST API consumer key and secret (WooCommerce > Settings > Advanced > REST API) and review the store for unexpected orders, products or users.","status":"open","published_at":"2026-11-14T07:17:17+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:21+00:00","updated_at":"2026-11-14T07:29:25+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-14T07:28:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Chargely plugin leaks WooCommerce API keys to anyone unauthenticated","impact":"high","summary":"The Chargely Free Subscriptions for WooCommerce WordPress plugin through version 1.0 exposes a REST API route without any authorization check. An unauthenticated attacker can read the stored WooCommerce REST API consumer key and secret, which grant read and write access to the whole store.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","woocommerce","chargely"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads WooCommerce keys and gains read and write store access.","analyst_note":"Confirm the fixed version or removal status of the plugin and whether a patch exists; the NVD entry gave no fix or severity.","how_to_check":"- Check whether the Chargely Free Subscriptions for WooCommerce plugin is installed and at version `1.0` or earlier in the WordPress plugins list.\n- Look for the plugin's REST API routes under `/wp-json/` and test whether they answer without authentication.\n- unknown for any other check the sources do not describe.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Stores running the Chargely Free Subscriptions for WooCommerce WordPress plugin through version 1.0 are exposed, because the plugin's REST route returns its stored WooCommerce consumer key and secret without checking who asks. Sites that do not have this plugin installed are not affected. The sources do not say whether a default configuration or any setting changes exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00077,"input_tokens":4560,"output_tokens":627,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version or removal status of the plugin and whether a patch exists; the NVD entry gave no fix or severity.","search":"'-116528':13A,16A '-2026':12A,15A '1.0':40B,83C 'access':69B,121C 'allow':100C 'anyon':9A 'api':6A,44B,59B,93C,109C 'attack':52B,102C 'author':48B,88C 'charg':2A,23B,31B,75C 'chargely':18A 'chargely-free-subscriptions-for-woocommerce':17A 'check':49B,89C 'configur':99C 'consum':60B,110C 'cve':11A,14A 'expos':41B 'for':21A 'free':19A,32B,76C 'grant':65B,117C 'hold':115C 'key':7A,61B,111C 'leak':4A 'live':106C 'perform':86C 'plugin':3A,29B,37B,81C 'read':54B,66B,118C 'rest':43B,58B,92C,108C 'retriev':104C 'return':96C 'rout':45B,94C 'secret':63B,113C 'store':56B,73B,98C,125C 'subscript':33B,77C 'subscriptions':20A 'unauthent':10A,51B,101C 'version':39B 'whole':72B,124C 'without':46B 'woocommerc':5A,25B,35B,57B,107C 'woocommerce':22A 'woocommernc':79C 'wordpress':1A,26B,28B,36B,80C 'wordpress-plugin':27B 'write':68B,120C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Chargely Free Subscriptions for WooCommerce WordPress plugin through version 1.0 are exposed, because the plugin's REST route returns its stored WooCommerce consumer key and secret without checking who asks. Sites that do not have this plugin installed are not affected. The sources do not say whether a default configuration or any setting changes exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["chargelyfreesubscriptionsforwoocommerce"],"ptokens":["chargely","for","free","subscriptions","woocommerce"],"labels":["chargely","high","other","woocommerce","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-116528':13A,16A '-2026':12A,15A 'anyon':9A 'api':6A 'charg':2A 'chargely':18A 'chargely-free-subscriptions-for-woocommerce':17A 'cve':11A,14A 'for':21A 'free':19A 'key':7A 'leak':4A 'plugin':3A 'subscriptions':20A 'unauthent':10A 'woocommerc':5A 'woocommerce':22A 'wordpress':1A","search_b":"'1.0':40B 'access':69B 'api':44B,59B 'attack':52B 'author':48B 'charg':23B,31B 'check':49B 'consum':60B 'expos':41B 'free':32B 'grant':65B 'key':61B 'plugin':29B,37B 'read':54B,66B 'rest':43B,58B 'rout':45B 'secret':63B 'store':56B,73B 'subscript':33B 'unauthent':51B 'version':39B 'whole':72B 'without':46B 'woocommerc':25B,35B,57B 'wordpress':26B,28B,36B 'wordpress-plugin':27B 'write':68B","search_c":"'1.0':83C 'access':121C 'allow':100C 'api':93C,109C 'attack':102C 'author':88C 'charg':75C 'check':89C 'configur':99C 'consum':110C 'free':76C 'grant':117C 'hold':115C 'key':111C 'live':106C 'perform':86C 'plugin':81C 'read':118C 'rest':92C,108C 'retriev':104C 'return':96C 'rout':94C 'secret':113C 'store':98C,125C 'subscript':77C 'unauthent':101C 'whole':124C 'woocommerc':107C 'woocommernc':79C 'wordpress':80C 'write':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116528","severity":null,"published_at":"2026-11-14T07:17:17+00:00","modified_at":"2026-11-14T07:17:17+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116528:3965","url":"https://wordpress.org/plugins/chargely-free-subscriptions-for-woocommerce/","severity":null,"published_at":"2026-11-14T07:29:25+00:00","modified_at":"2026-11-14T07:29:25+00:00","first_seen_at":"2026-11-14T07:29:25+00:00","fetched_at":"2026-11-14T07:29:25+00:00","note":"WPScan-sourced CVE via cvefeed; WordPress.org lists plugin closed 2026-10-28 pending review, no fixed version exists. Only 1.0 was ever released. No exploitation or PoC seen; no social search (obscure plugin). Nothing verified: no vendor advisory.","cites":["https://wordpress.org/plugins/chargely-free-subscriptions-for-woocommerce/","https://cvefeed.io/vuln/detail/CVE-2026-116528"]}],"documents":[{"id":153718,"url":"https://wordpress.org/plugins/chargely-free-subscriptions-for-woocommerce/","title":"Chargely Free Subscriptions For Woocommernce - WordPress.org (closed)","kind":"vendor","source":"analyst","publisher":null,"text":"This plugin has been closed as of October 28, 2026 and is not available for download. This closure is temporary, pending a full review. Version 1.0, last updated May 20, 2023.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":153719,"url":"https://cvefeed.io/vuln/detail/CVE-2026-116528","title":"CVE-2026-116528 Chargely Free Subscriptions <= 1.0 Unauthenticated WooCommerce REST API Credential Disclosure (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}