# CVE-2026-16569: ShopApper Mobile App for WooCommerce privilege escalation in stock update

Source: https://junglewise.ai/threats/cve-2026-16569-shopapper-mobile-app-for-woocommerce-privilege-escalation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16569 · Severity: medium · CVSS 4.3 · Published 2026-08-27

The ShopApper Mobile App Builder plugin for WooCommerce allows any authenticated user (including unprivileged customers) to arbitrarily modify product stock quantities via a REST endpoint. This enables low-privilege attackers to manipulate inventory levels without proper authorization, disrupting business operations and potentially enabling inventory fraud or denial-of-service attacks against the e-commerce platform.

Technologies: [ShopApper Mobile App for WooCommerce](https://junglewise.ai/threats/technologies/mobile-app-for-woocommerce). Vendors: [ShopApper](https://junglewise.ai/threats/vendors/shopapper).

## Quick answers

**Is CVE-2026-16569 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16569 being exploited in the wild.

**How severe is CVE-2026-16569?** Medium severity, with a CVSS score of 4.3, published 27 August 2026.

**Which products and versions are affected?** ShopApper Mobile App for WooCommerce through 0.4.69.

**Is there a fix for CVE-2026-16569?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16569 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-16569?** Check whether you run ShopApper Mobile App for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing capability check (broken access control, CWE-284) in the REST API endpoint /wp-json/shopapper/client/v1/product/batch-update-stock. The endpoint accepts authenticated requests (verified via REST nonce) but does not validate whether the user has shop management or product editing permissions. Any logged-in user, including customers or subscribers, can send a POST request with a product ID and desired stock quantity to modify inventory. An attacker needs only a valid session cookie and REST nonce to exploit this; no special tools or out-of-band interaction is required. The plugin versions up to 0.4.69 are affected, and no fix is currently available.

## Affected products

- ShopApper Mobile App for WooCommerce through 0.4.69

## Timeline

- 2026-08-25: disclosed
- 2026-08-27: advisory

## References

- [https://wpscan.com/vulnerability/0d96cc80-0bba-45e4-8e07-220dc8b82c7d/](https://wpscan.com/vulnerability/0d96cc80-0bba-45e4-8e07-220dc8b82c7d/)

## Related threats

- [Mobile App for WooCommerce broken access control vulnerability](https://junglewise.ai/threats/cve-2026-27330-mobile-app-for-woocommerce-broken-access-control-vulnerability)
- [ShopApper Mobile App Builder insecure direct object reference in REST API](https://junglewise.ai/threats/cve-2026-16568-shopapper-mobile-app-builder-insecure-direct-object-reference-in)