Unrated severityNVD Advisory· Published Jul 29, 2026· Updated Jul 29, 2026
ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure
CVE-2026-11351
Description
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.0.17
Patches
Vulnerability mechanics
References
1- wpscan.com/vulnerability/cac3a0c4-e6b9-42a6-b702-abcba67038c2/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.