CVE-2026-7529 is a missing authorization vulnerability (CWE-862) in the wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress. The issue arises because every REST API endpoint is registered with `permission_callback => '__return_true'`, effectively disabling any authorization checks. This flaw affects all versions up to and including 1.1.16. Exploitation allows unauthenticated attackers to read and modify plugin data such as banners, stockbar settings, feature flags, and upload files via wp_handle_upload(), without any nonce or capability verification.

An unauthenticated attacker can modify plugin configuration and data, including banners and stockbar settings, and upload files to the server. This can lead to unauthorized changes in website content and potentially uploading malicious files, impacting the integrity of the affected WordPress site. The vulnerability does not impact confidentiality but has a high impact on integrity and no impact on availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API endpoints of this plugin if possible, and monitor for suspicious activity related to plugin settings modification. Avoid using affected versions in production environments.