Executive brief
ShopApper is a WordPress plugin that enables businesses to build and manage mobile apps for their WooCommerce stores. A flaw in its REST API allows any authenticated user (including low-privilege customers) to retrieve other users' personal data—including email addresses, names, and administrative roles—by simply changing a numeric ID parameter in their API requests. An attacker needs only a basic customer account to enumerate and harvest sensitive information from all registered accounts.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the ShopApper REST endpoint `/wp-json/shopapper/client/v1/customers/{id}`. The endpoint accepts a customer ID parameter but fails to verify that the authenticated user owns or has permission to access the requested customer profile. An attacker with a valid WooCommerce API key (obtainable via ordinary customer registration) can craft requests to iterate through customer IDs and retrieve arbitrary users' personal information, including email, display name, avatar URL, last order ID, and user roles. The vulnerability requires only authentication (subscriber-level access) and network reachability to the vulnerable endpoint; no admin privileges or CSRF is necessary. Patches are available in versions after 0.4.69.
Affected products
- ShopApper Mobile App for WooCommerce through 0.4.62
Timeline
- 2026-08-25: disclosed
- 2026-08-27: advisory