CVE-2026-11351

ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.

Affected

ShinyStat Analytics

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 27th percentile

Published

2026-07-29

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/cac3a0c4-e6b9-42a6-b702-abcba67038c2/

References

• CVE Record
• NVD entry