CVE-2026-92404 — MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure
The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommer…
Published: 2026-09-19 · CVSS: 7.5 · CVSS 3.1
The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7