CVE-2026-16569

The ShopApper Mobile App Builder Service WordPress plugin (through version 0.4.62 ) fails to verify user capabilities before processing a stock-update request via one of its REST endpoints. This allows any authenticated user, including low-privilege roles such as customer or subscriber , to modif...