UNKNOWN NVD

CVE-2026-14832

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to u

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.

References

https://wpscan.com/vulnerability/3b651e19-37f5-468e-8d0b-a82bbe04eaf2/

Published: 2026-08-17 · Source: NVD · Feed updated: 2026-08-17

This unknown severity vulnerability was published on 2026-08-17 via NVD.

vulnfeed aggregates 11808 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.