Wisecampaign – Woocommerce Conversions Made Easy
Approved changes feed: RSS · Atom
cpe:2.3:a:wisemattic:wisecampaign_–_woocommerce_conversions_made_easy:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Wisemattic (1cd328f5-9e09-5d55-9b90-849605d741d6) |
|---|---|
| Product | Wisecampaign – Woocommerce Conversions Made Easy (e4776a3b-4aea-58b7-a860-70d9f0e12af9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-7529 |
vulnerable | 2026-09-16 04:34:10.884781 |
wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API
HIGH (7.5)
The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin's banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload() — without any nonce or capability check.
Published: 2026-08-05T13:26:42.740Z
Updated: 2026-08-05T14:43:46.036Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.