{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/printaura/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:printaura:printaura-woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-115733"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Printaura-Woocommerce (\u003c= 4.0.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Printaura"],"content_html":"\u003cp\u003eThe Printaura-Woocommerce plugin (versions 4.0.2 and earlier) contains a critical authentication bypass vulnerability (CVE-2026-115733). The flaw resides in an improper access control implementation that forces all WooCommerce REST API routes to accept unauthenticated requests. This allows an attacker to interact with the API as if they were an authorized user, leading to potential exfiltration of customer PII, order history, and unauthorized modification of site settings or payment configurations. No patch information is currently provided by the vendor.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to perform unauthorized CRUD operations on store data. This includes accessing customer order details, personal identifiable information, modifying payment settings, and interacting with store webhooks, which could lead to secondary impacts such as financial fraud or site compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all WordPress instances running the Printaura-Woocommerce plugin.\u003c/li\u003e\n\u003cli\u003eDisable the Printaura-Woocommerce plugin immediately until a security update is released by the vendor.\u003c/li\u003e\n\u003cli\u003eAudit WooCommerce REST API access logs for unauthorized requests originating from unknown IP addresses, particularly focusing on requests to endpoints that should require authentication.\u003c/li\u003e\n\u003cli\u003eIf disabling the plugin is not immediately feasible, restrict access to the WordPress site's REST API using a Web Application Firewall (WAF) or server-side configuration to block access to '/wp-json/wc/v*' from untrusted sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:59:01Z","date_published":"2026-11-11T13:59:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-printaura-woocommerce-auth-bypass-cve-2026-115733/","summary":"The Printaura-Woocommerce plugin through 4.0.2 fails to restrict access to the WooCommerce REST API, enabling unauthenticated remote attackers to read or modify sensitive store data, configurations, and payment settings.","title":"Printaura-Woocommerce: Unauthenticated WooCommerce REST API access (CVE-2026-115733)","url":"https://feed.craftedsignal.io/briefs/2026-11-printaura-woocommerce-auth-bypass-cve-2026-115733/"}],"language":"en","title":"CraftedSignal Threat Feed - Printaura","version":"https://jsonfeed.org/version/1.1"}