CVE-2026-114195: Insertion of Sensitive Information into Externally-Accessible File or Directory in WP Desk ShopMagic

The vulnerability identified as CVE-2026-114195 affects the WP Desk ShopMagic plugin for WooCommerce, allowing insertion of sensitive information into files or directories that are accessible externally. This flaw could lead to unauthorized retrieval of sensitive embedded data. The affected versions include all releases from the initial version up to, but not including, 4.9.2. The CVSS 3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. There is no information on known exploits in the wild or vendor-provided patches.

The vulnerability allows an attacker to retrieve sensitive information embedded in files or directories that are accessible externally, potentially exposing confidential data. The impact is limited to confidentiality with no integrity or availability impact. The medium severity score reflects the potential for unauthorized data disclosure without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor WP Desk advisories for updates. Until a fix is available, consider restricting external access to ShopMagic files and directories where sensitive information might be stored.