Is CVE-2026-16569 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16569 being exploited in the wild.

How severe is CVE-2026-16569?

Medium severity, with a CVSS score of 4.3, published 27 August 2026.

Which products and versions are affected?

ShopApper Mobile App for WooCommerce through 0.4.69.

Is there a fix for CVE-2026-16569?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16569 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-16569?

Check whether you run ShopApper Mobile App for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16569: ShopApper Mobile App for WooCommerce privilege escalation in stock update

CVE-2026-16569 · Severity: medium · CVSS 4.3 · Published 2026-08-27

The ShopApper Mobile App Builder plugin for WooCommerce allows any authenticated user (including unprivileged customers) to arbitrarily modify product stock quantities via a REST endpoint. This enables low-privilege attackers to manipulate inventory levels without proper authorization, disrupting business operations and potentially enabling inventory fraud or denial-of-service attacks against the e-commerce platform.

Technologies: ShopApper Mobile App for WooCommerce. Vendors: ShopApper.

Quick answers

Is CVE-2026-16569 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16569 being exploited in the wild.
How severe is CVE-2026-16569?: Medium severity, with a CVSS score of 4.3, published 27 August 2026.
Which products and versions are affected?: ShopApper Mobile App for WooCommerce through 0.4.69.
Is there a fix for CVE-2026-16569?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16569 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-16569?: Check whether you run ShopApper Mobile App for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing capability check (broken access control, CWE-284) in the REST API endpoint /wp-json/shopapper/client/v1/product/batch-update-stock. The endpoint accepts authenticated requests (verified via REST nonce) but does not validate whether the user has shop management or product editing permissions. Any logged-in user, including customers or subscribers, can send a POST request with a product ID and desired stock quantity to modify inventory. An attacker needs only a valid session cookie and REST nonce to exploit this; no special tools or out-of-band interaction is required. The plugin versions up to 0.4.69 are affected, and no fix is currently available.

Affected products

ShopApper Mobile App for WooCommerce through 0.4.69

Timeline

2026-08-25: disclosed
2026-08-27: advisory

References

https://wpscan.com/vulnerability/0d96cc80-0bba-45e4-8e07-220dc8b82c7d/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.