Executive brief
The ShinyStat Analytics plugin for WordPress, used for website traffic monitoring, contains a security flaw that allows unauthorized individuals to view hidden product information. An attacker can access details about draft, private, or pending WooCommerce products that are not yet intended for public view. This could lead to the exposure of upcoming product launches, confidential pricing, and internal descriptions, potentially damaging a company's competitive advantage or marketing strategy.
Technical details
The ShinyStat Analytics plugin fails to implement authorization checks on a specific REST API endpoint. The route 'shinystat/v1/product/<id>' is registered with a permission_callback set to '__return_true', effectively allowing any unauthenticated network user to query it. The underlying handler uses 'wc_get_product()' to retrieve product data without verifying the post status (e.g., draft, private, or pending). By enumerating sequential WordPress post IDs, an attacker can leak sensitive WooCommerce product details including titles, descriptions, permalinks, and pricing information. This issue is resolved in version 1.0.17.
Affected products
- ShinyStat ShinyStat Analytics < 1.0.17
Timeline
- 2026-07-08: disclosed: Initial public disclosure by WPScan
- 2026-07-29: advisory: NVD publication date