CVE-2026-11351 ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published e.g. draft, pending or private WooCommerce products...