What is CVE-2026-16568?

CVE-2026-16568 is a medium-severity vulnerability in Mobile App For Woocommerce: Shopapper Builder Service Woocommerce, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-08-27.

How severe is CVE-2026-16568?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Mobile App For Woocommerce: Shopapper Builder Service Woocommerce

CVE-2026-16568

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.001 (3.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Unknown Mobile App For Woocommerce: Shopapper Builder Service Woocommerce

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-16568?: CVE-2026-16568 is a medium-severity vulnerability in Mobile App For Woocommerce: Shopapper Builder Service Woocommerce, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-08-27.
How severe is CVE-2026-16568?: Medium severity. CVSS v3 base score is 4.3 out of 10.