Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows… (CVE-2026-114195)

The vulnerability in ShopMagic for WooCommerce involves the insertion of sensitive information into externally accessible files or directories, which can be retrieved by unauthorized parties. This exposure arises from improper handling of sensitive data within the plugin, potentially allowing attackers to access confidential information embedded in these files. The affected versions include all versions up to 4.9.1. The CVSS 3.1 vector indicates the vulnerability is exploitable remotely without privileges or user interaction, with low impact on confidentiality and no impact on integrity or availability.

An attacker can remotely retrieve sensitive information embedded in files or directories exposed by the ShopMagic plugin. This could lead to information disclosure but does not affect data integrity or availability. The confidentiality impact is rated low, and there are no known exploits in the wild.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to files and directories created or used by ShopMagic to prevent unauthorized external access.