CVE-2026-92404

The MgoSync WordPress plugin (versions 2.1.5–2.1.6) lacks authorization controls on one of its REST API endpoints. This allows unauthenticated users to retrieve the stored WooCommerce API credentials — specifically a read/write consumer key and secret — from any configured site, potentially grant...