Printaura-Woocommerce: Unauthenticated WooCommerce REST API access (CVE-2026-115733)

The Printaura-Woocommerce plugin (versions 4.0.2 and earlier) contains a critical authentication bypass vulnerability (CVE-2026-115733). The flaw resides in an improper access control implementation that forces all WooCommerce REST API routes to accept unauthenticated requests. This allows an attacker to interact with the API as if they were an authorized user, leading to potential exfiltration of customer PII, order history, and unauthorized modification of site settings or payment configurations. No patch information is currently provided by the vendor.

Impact

Successful exploitation allows unauthenticated attackers to perform unauthorized CRUD operations on store data. This includes accessing customer order details, personal identifiable information, modifying payment settings, and interacting with store webhooks, which could lead to secondary impacts such as financial fraud or site compromise.

Recommendation

• Inventory all WordPress instances running the Printaura-Woocommerce plugin.
• Disable the Printaura-Woocommerce plugin immediately until a security update is released by the vendor.
• Audit WooCommerce REST API access logs for unauthorized requests originating from unknown IP addresses, particularly focusing on requests to endpoints that should require authentication.
• If disabling the plugin is not immediately feasible, restrict access to the WordPress site's REST API using a Web Application Firewall (WAF) or server-side configuration to block access to '/wp-json/wc/v*' from untrusted sources.