Quick answers
- Is CVE-2026-16568 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16568 being exploited in the wild.
- How severe is CVE-2026-16568?
- Medium severity, with a CVSS score of 4.3, published 27 August 2026.
- Which products and versions are affected?
- ShopApper Mobile App for WooCommerce through 0.4.62.
- Is there a fix for CVE-2026-16568?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-16568 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-16568?
- Check whether you run ShopApper Mobile App for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the ShopApper REST endpoint `/wp-json/shopapper/client/v1/customers/{id}`. The endpoint accepts a customer ID parameter but fails to verify that the authenticated user owns or has permission to access the requested customer profile. An attacker with a valid WooCommerce API key (obtainable via ordinary customer registration) can craft requests to iterate through customer IDs and retrieve arbitrary users' personal information, including email, display name, avatar URL, last order ID, and user roles. The vulnerability requires only authentication (subscriber-level access) and network reachability to the vulnerable endpoint; no admin privileges or CSRF is necessary. Patches are available in versions after 0.4.69.
Affected products
- ShopApper Mobile App for WooCommerce through 0.4.62
Timeline
- 2026-08-25: disclosed
- 2026-08-27: advisory