Executive brief
ShopSmart Loyalty for WooCommerce is a WordPress plugin that integrates customer loyalty programs with online stores. The plugin exposes an unauthenticated endpoint that allows anyone to retrieve detailed customer profiles—including name, email, and account balance—by simply entering a customer's phone number. This enables customer data theft and potential identity fraud or targeted social engineering attacks.
Technical details
The plugin contains an Insecure Direct Object Reference (IDOR) vulnerability in its unauthenticated AJAX handler for phone-number lookups (action=shopsmart_check_phone). The only access control is a WordPress nonce minted for any anonymous visitor on the checkout page; there is no capability check, ownership verification, or one-time password validation before calling the upstream loyalty API. An attacker can retrieve a valid nonce from the checkout page, then query the endpoint with any phone number to extract full customer loyalty profiles. The vulnerability affects ShopSmart Loyalty for WooCommerce through version 1.0.0; no official patch is currently available.
Affected products
- ShopSmart Loyalty for WooCommerce through 1.0.0
Timeline
- 2026-08-17: disclosed: CVE-2026-14832 published
- 2026-08-14: other: Vulnerability publicly reported on WPScan