CVE-2026-11351 is an information exposure vulnerability (CWE-200) in the ShinyStat Analytics WordPress plugin. Versions prior to 1.0.17, including version 1.0.12, do not enforce authorization on a specific REST API endpoint. This flaw permits unauthenticated attackers to retrieve sensitive information about WooCommerce products that are not publicly available, including drafts, pending, or private products. No CVSS score or official remediation guidance is currently available, and no known exploits have been reported in the wild.

Unauthenticated users can access potentially sensitive information about non-published WooCommerce products via the vulnerable REST API endpoint. This exposure could lead to information disclosure that might assist attackers in further targeting or reconnaissance. There is no indication of direct code execution or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.0.17 and specifically version 1.0.12 is affected, upgrading to version 1.0.17 or later (once available) is recommended if the vendor releases a fix. Until then, restrict access to the REST API endpoints or disable the plugin if possible to prevent unauthorized information disclosure.