Executive brief
The MgoSync WordPress plugin for WooCommerce store integration contains an unprotected REST API endpoint that exposes stored WooCommerce API credentials without requiring authentication. An attacker can remotely retrieve the read/write consumer key and secret, gaining full access to the target store's API for data theft, modification, or deletion.
Technical details
The plugin fails to implement authorization checks on a REST API endpoint, allowing unauthenticated users to retrieve WooCommerce API credentials via network request. This is a sensitive data disclosure vulnerability (CWE-200) requiring only network access with no user interaction. An attacker gains the ability to impersonate the store in WooCommerce API calls.
Affected products
- Megamo MgoSync before 2.1.7
Timeline
- 2026-09-17: disclosed
- 2026-09-19: patched: Fixed in version 2.1.7