CVE-2026-16568: CWE-639 Authorization Bypass Through User-Controlled Key in Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce

The vulnerability identified as CVE-2026-16568 affects the Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin up to version 0.4.62. It arises because the plugin does not verify that the authenticated user making a request to a specific REST endpoint actually owns the customer profile being queried. This authorization bypass (CWE-639) enables any authenticated user, including customers or subscribers, to retrieve personal data of other users, such as their email addresses, names, and roles. The CVSS v3.1 base score is 4.3, indicating medium severity, with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and only impacting confidentiality.

The vulnerability allows unauthorized disclosure of personal data belonging to other users of the WooCommerce mobile app. While it does not affect data integrity or availability, the exposure of email addresses, names, and roles can lead to privacy violations and potential further targeted attacks. There are no known exploits in the wild at this time.

No official patch or remediation level has been published yet for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected REST endpoints to trusted users or disable the vulnerable functionality if possible.