CVE-2026-11351 — ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve info…
Published: 2026-07-29 · CVSS: 5.3 · CVSS 3.1
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7