CVE-2026-103323: CWE-862 Missing Authorization in Integration for Epos Now and WooCommerce

CVE-2026-103323 describes a missing authorization check (CWE-862) in the Integration for Epos Now and WooCommerce WordPress plugin prior to version 4.11.2. Specifically, one REST endpoint does not verify whether the requester is authorized, enabling unauthenticated users to retrieve scheduled background tasks and their parameters. These parameters may expose order identifiers and, when WooCommerce's deferred emails feature is active, plaintext passwords of newly registered customers. This vulnerability affects plugin versions from 4.6.0 up to but not including 4.11.2.

An attacker can access sensitive information without authentication, including order identifiers and potentially plaintext customer passwords if the deferred emails feature is enabled. This exposure risks customer account compromise and privacy violations. There is no indication of active exploitation in the wild at this time.

Upgrade the Integration for Epos Now and WooCommerce plugin to version 4.11.2 or later, where this authorization issue has been fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the version range of affected versions and the fixed version 4.11.2.