Executive brief
WPC Smart Compare is a WordPress plugin that allows customers to compare product features in WooCommerce stores. The plugin fails to enforce WordPress's password protection on products when returning content through its comparison feature, exposing product descriptions of password-protected items to anyone without authentication. This allows competitors or unauthorized users to view sensitive product information that store owners intended to keep private.
Technical details
The vulnerability exists in the plugin's comparison handler (woosc_load) which bypasses WordPress post-password protection checks when retrieving product content. Unauthenticated attackers can directly access password-protected product descriptions through this handler without needing to authenticate or provide the product password. The issue affects WPC Smart Compare versions prior to 6.6.1 and is remedied by enforcing proper password protection checks before returning product data.
Affected products
- WP Woo Smart Plugins WPC Smart Compare for WooCommerce before 6.6.1
Timeline
- 2026-09-21: disclosed
- 2026-09-21: patched: Version 6.6.1 released