WordPress MgoSync plugin 2.1.5-2.1.6 - Unauthenticated WooCommerce API Credential Disclosure vulnerability

Unauthenticated WooCommerce API Credential Disclosure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin MgoSync versions 2.1.5-2.1.6...

CVE-2026-92404

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-92404 MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-92404 MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-92404

The MgoSync WordPress plugin versions 2.1.5 through 2.1.6 is vulnerable to an unauthenticated WooCommerce API Credential Disclosure vulnerability. Due to a lack of authorization controls on a specific REST API endpoint , an unauthenticated user can retrieve stored WooCommerce API credentials, inc...

EUVD-2026-83512

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

PT-2026-95765

Name of the Vulnerable Software and Affected Versions MgoSync WordPress plugin versions prior to 2.1.7 Description The plugin lacks authorization controls on a REST API endpoint, which enables unauthenticated users to retrieve stored WooCommerce API credentials. This includes the read/write...

CVE-2026-92404: Exposure of Sensitive Information to an Unauthorized Actor

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...