Executive brief
The ShopApper Mobile App Builder plugin for WooCommerce allows any authenticated user (including unprivileged customers) to arbitrarily modify product stock quantities via a REST endpoint. This enables low-privilege attackers to manipulate inventory levels without proper authorization, disrupting business operations and potentially enabling inventory fraud or denial-of-service attacks against the e-commerce platform.
Technical details
The vulnerability is a missing capability check (broken access control, CWE-284) in the REST API endpoint /wp-json/shopapper/client/v1/product/batch-update-stock. The endpoint accepts authenticated requests (verified via REST nonce) but does not validate whether the user has shop management or product editing permissions. Any logged-in user, including customers or subscribers, can send a POST request with a product ID and desired stock quantity to modify inventory. An attacker needs only a valid session cookie and REST nonce to exploit this; no special tools or out-of-band interaction is required. The plugin versions up to 0.4.69 are affected, and no fix is currently available.
Affected products
- ShopApper Mobile App for WooCommerce through 0.4.69
Timeline
- 2026-08-25: disclosed
- 2026-08-27: advisory