CVE-2026-88929: CWE-200 Information Exposure in Product Badge, Label, Countdown Timer for WooCommerce
The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.
AI Analysis
Technical Summary
CVE-2026-88929 is an information exposure vulnerability (CWE-200) in the Product Badge, Label, Countdown Timer for WooCommerce plugin for WordPress. Versions from 7.0.0 up to 7.5.2 do not properly check the publication status of products before returning product details to unauthenticated users. This flaw permits unauthorized access to sensitive product information such as titles, descriptions, and prices of products that are not yet published or are private.
Potential Impact
Unauthenticated users can access sensitive product information that should be restricted, including titles, descriptions, and prices of draft, pending, and private products. This exposure could lead to information disclosure that might affect business confidentiality or competitive advantage.
Mitigation Recommendations
Upgrade the Product Badge, Label, Countdown Timer for WooCommerce plugin to version 7.5.2 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory.
CVE-2026-88929: CWE-200 Information Exposure in Product Badge, Label, Countdown Timer for WooCommerce
Description
The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.
CVSS v3.1
Score 5.3medium
Affected software
Product Badge, Label, Countdown Timer for WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-88929 is an information exposure vulnerability (CWE-200) in the Product Badge, Label, Countdown Timer for WooCommerce plugin for WordPress. Versions from 7.0.0 up to 7.5.2 do not properly check the publication status of products before returning product details to unauthenticated users. This flaw permits unauthorized access to sensitive product information such as titles, descriptions, and prices of products that are not yet published or are private.
Potential Impact
Unauthenticated users can access sensitive product information that should be restricted, including titles, descriptions, and prices of draft, pending, and private products. This exposure could lead to information disclosure that might affect business confidentiality or competitive advantage.
Mitigation Recommendations
Upgrade the Product Badge, Label, Countdown Timer for WooCommerce plugin to version 7.5.2 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-10T14:12:11.568Z
- State
- PUBLISHED
Threat ID: 6ab36d43f7a7c541065abcc8
Added to database: 09/23/2026, 06:10:11 UTC
Last enriched: 09/23/2026, 06:18:28 UTC
Last updated: 09/23/2026, 22:02:19 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.