CVE-2026-92404

HIGH CVSS 7.5 View on NVD ↗

Description

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://wpscan.com/vulnerability/342e79ec-cfe6-43f3-8598-bf2b83aff2a1/

Published: Sep 19, 2026 07:16 UTC Modified: Sep 19, 2026 14:17 UTC