# CVE-2026-16568: ShopApper Mobile App Builder insecure direct object reference in REST API

Source: https://junglewise.ai/threats/cve-2026-16568-shopapper-mobile-app-builder-insecure-direct-object-reference-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16568 · Severity: medium · CVSS 4.3 · Published 2026-08-27

ShopApper is a WordPress plugin that enables businesses to build and manage mobile apps for their WooCommerce stores. A flaw in its REST API allows any authenticated user (including low-privilege customers) to retrieve other users' personal data—including email addresses, names, and administrative roles—by simply changing a numeric ID parameter in their API requests. An attacker needs only a basic customer account to enumerate and harvest sensitive information from all registered accounts.

Technologies: [ShopApper Mobile App for WooCommerce](https://junglewise.ai/threats/technologies/mobile-app-for-woocommerce). Vendors: [ShopApper](https://junglewise.ai/threats/vendors/shopapper).

## Quick answers

**Is CVE-2026-16568 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16568 being exploited in the wild.

**How severe is CVE-2026-16568?** Medium severity, with a CVSS score of 4.3, published 27 August 2026.

**Which products and versions are affected?** ShopApper Mobile App for WooCommerce through 0.4.62.

**Is there a fix for CVE-2026-16568?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16568 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16568?** Check whether you run ShopApper Mobile App for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the ShopApper REST endpoint `/wp-json/shopapper/client/v1/customers/{id}`. The endpoint accepts a customer ID parameter but fails to verify that the authenticated user owns or has permission to access the requested customer profile. An attacker with a valid WooCommerce API key (obtainable via ordinary customer registration) can craft requests to iterate through customer IDs and retrieve arbitrary users' personal information, including email, display name, avatar URL, last order ID, and user roles. The vulnerability requires only authentication (subscriber-level access) and network reachability to the vulnerable endpoint; no admin privileges or CSRF is necessary. Patches are available in versions after 0.4.69.

## Affected products

- ShopApper Mobile App for WooCommerce through 0.4.62

## Timeline

- 2026-08-25: disclosed
- 2026-08-27: advisory

## References

- [https://wpscan.com/vulnerability/489be79d-df68-4384-83ab-c3fa5400eadc/](https://wpscan.com/vulnerability/489be79d-df68-4384-83ab-c3fa5400eadc/)

## Related threats

- [Mobile App for WooCommerce broken access control vulnerability](https://junglewise.ai/threats/cve-2026-27330-mobile-app-for-woocommerce-broken-access-control-vulnerability)
- [ShopApper Mobile App for WooCommerce privilege escalation in stock update](https://junglewise.ai/threats/cve-2026-16569-shopapper-mobile-app-for-woocommerce-privilege-escalation-in)