CVE-2026-14832 describes an authorization bypass vulnerability in the ShopSmart Loyalty for WooCommerce WordPress plugin up to version 1.0.0. The vulnerability arises from the lack of authorization or ownership checks on a phone-number lookup endpoint accessible to unauthenticated users. Exploiting this flaw allows an attacker to obtain loyalty profile details of any customer by simply knowing their phone number. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker can retrieve sensitive customer information such as name, email address, and loyalty account balance without authentication. This exposure compromises customer privacy but does not affect data integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the phone-number lookup functionality or disable the ShopSmart Loyalty plugin if possible to prevent unauthorized data disclosure.