Auth bypass in Mobile App For Woocommerce: Shopapper Builder Service Woocommerce

CVE-2026-16568

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.

Vulnerability class: IDOR (Insecure Direct Object Reference)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.002 (4.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 4.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-16568: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: -0.000

Affected products

  • Mobile App For Woocommerce: Shopapper Builder Service Woocommerce

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-16568?
CVE-2026-16568 is a medium-severity vulnerability in Mobile App For Woocommerce: Shopapper Builder Service Woocommerce, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-08-27.
How severe is CVE-2026-16568?
Medium severity. CVSS v3 base score is 4.3 out of 10.