CVE-2026-92404

MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.

Affected

MgoSync

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.43% chance of exploitation in the next 30 days, 36th percentile

Published

2026-09-19

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/342e79ec-cfe6-43f3-8598-bf2b83aff2a1/

References

• CVE Record
• NVD entry