CVE-2026-11351 — ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure

CVE-2026-11351

ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure PUBLISHED

Description (CNA)

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.

Affected (CNA)

Vendor / product	Versions
Unknown / ShinyStat Analytics	affected 1.0.12 before 1.0.17

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/cac3a0c4-e6b9-42a6-b702-abcba67038c2/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.