CVE-2026-92404 — MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

CVE-2026-92404

MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure PUBLISHED

Description (CNA)

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.

Affected (CNA)

Vendor / product	Versions
Unknown / MgoSync	affected 2.1.5 before 2.1.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/342e79ec-cfe6-43f3-8598-bf2b83aff2a1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.