---
id: "CVE-2026-116528"
page: "https://infrastack.ai/live/CVE-2026-116528"
kind: "vulnerability"
aliases: ["CVE-2026-116528"]
title: "WordPress Chargely plugin leaks WooCommerce API keys to anyone unauthenticated"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "chargely-free-subscriptions-for-woocommerce", "fixed": [], "affected": "<= 1.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["chargely", "other", "woocommerce", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-14T07:17:17+00:00"
first_seen_at: "2026-11-14T07:27:45+00:00"
updated_at: "2026-11-14T07:29:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116528", "first_seen_at": "2026-11-14T07:27:45+00:00"}, {"source": "analyst", "url": "https://wordpress.org/plugins/chargely-free-subscriptions-for-woocommerce/", "first_seen_at": "2026-11-14T07:29:25+00:00", "cites": ["https://wordpress.org/plugins/chargely-free-subscriptions-for-woocommerce/", "https://cvefeed.io/vuln/detail/CVE-2026-116528"]}]
exploit_sources: []
---

# WordPress Chargely plugin leaks WooCommerce API keys to anyone unauthenticated

Link for people: https://infrastack.ai/live/CVE-2026-116528 (this .md is for agents)

The Chargely Free Subscriptions for WooCommerce WordPress plugin through version 1.0 exposes a REST API route without any authorization check. An unauthenticated attacker can read the stored WooCommerce REST API consumer key and secret, which grant read and write access to the whole store.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:chargely-free-subscriptions-for-woocommerce affected <= 1.0 fixed no fixed version listed

## How to check

- In WP admin > Plugins, look for 'Chargely Free Subscriptions For Woocommernce' (slug chargely-free-subscriptions-for-woocommerce). Version 1.0 is the only release, so any install is affected.
- Check WooCommerce > Settings > Advanced > REST API for keys the plugin created; treat them as exposed if the plugin was active and reachable.

## Fix

No patched version. The WordPress.org page says the plugin was closed on October 28, 2026, temporarily pending a full review, and is not available for download. Deactivate and delete the plugin, then rotate the WooCommerce REST API consumer key and secret (WooCommerce > Settings > Advanced > REST API) and review the store for unexpected orders, products or users.

## Timeline

- 2026-11-14T07:27:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116528
- 2026-11-14T07:29:25+00:00 analyst https://wordpress.org/plugins/chargely-free-subscriptions-for-woocommerce/ — WPScan-sourced CVE via cvefeed; WordPress.org lists plugin closed 2026-10-28 pending review, no fixed version exists. Only 1.0 was ever released. No exploitation or PoC seen; no social search (obscure plugin). Nothing verified: no vendor advisory.

## Documents

- [advisory] Chargely Free Subscriptions For Woocommernce - WordPress.org (closed) https://wordpress.org/plugins/chargely-free-subscriptions-for-woocommerce/
- [describes] CVE-2026-116528 Chargely Free Subscriptions <= 1.0 Unauthenticated WooCommerce REST API Credential Disclosure (WPScan) https://cvefeed.io/vuln/detail/CVE-2026-116528

## From the sources

The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_