External risk intelligence

Printaura WooCommerce Plugin REST API Unauthenticated Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-115733

The vulnerability affects a WordPress plugin that extends the WooCommerce REST API. WooCommerce stores are inherently designed to be public-facing web applications, making their API endpoints, particularly those related to store data and customer orders, exposed to the public internet by design in normal operations.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in a WordPress plugin allows unauthorized access to sensitive online store data. It could enable attackers to view and alter customer orders, personal details, and payment settings, potentially impacting business operations and customer trust. The main concern is confirming relevance and exposure.

Unauthenticated access to store data is possible.
Protects customer orders and payment information.
Confirm if your online store is affected.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can leverage this vulnerability to access sensitive WooCommerce store data. This is possible because the plugin fails to properly restrict access to the WooCommerce REST API, allowing anyone to make requests to it without logging in. By exploiting this, an attacker could read and alter critical information such as customer orders, personal details, payment settings, and webhooks.

No authentication required.
Access any WooCommerce REST API endpoint.
Read and modify store data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to access and alter sensitive WooCommerce store data, including customer orders and personal details, as well as payment and store settings. This exposure is possible when the affected plugin is active and its WooCommerce REST API endpoints are accessible over the network.

Store data and customer information.
Unauthenticated access to REST API.
Unauthorized data modification and exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

The critical vulnerability in the Printaura-Woocommerce WordPress plugin, which exposes the WooCommerce REST API to unauthenticated access, likely falls under the responsibility of E-commerce platform owners or website administrators who manage the WooCommerce storefront. The first practical step is to identify all instances of the affected plugin, determine their exposure and business criticality, and then coordinate with the responsible teams for remediation.

E-commerce platform owners own this issue.
Verify API endpoint exposure and business criticality.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Printaura-Woocommerce WordPress plugin?

This plugin acts as a bridge between the Printaura print-on-demand service and the WooCommerce e-commerce platform. It enables store owners to sync product catalogs and automate order fulfillment directly through WordPress.

How does CVE-2026-115733 affect data security?

The vulnerability is categorized as Improper Authentication (CWE-287). It causes the plugin to bypass standard security checks, meaning the WooCommerce REST API fails to verify the identity of anyone making a request, granting unauthorized access to store data.

Do I need to be logged into the store for this to be triggered?

No. The vulnerability allows unauthenticated requests, meaning an attacker does not need an account or valid credentials. The issue triggers simply by sending requests to the affected API endpoints, provided the plugin is installed and active on the site.

Why should I worry about this if my store is online?

According to Halo Surface Signal, WooCommerce stores are designed to be public-facing web applications. Because the plugin exposes the REST API to the internet, any remote attacker can reach these endpoints, making your customer orders and payment settings highly accessible.

How should I respond to this vulnerability?

Identify if your website is running the Printaura-Woocommerce plugin. If it is, verify the business criticality of the plugin and your exposure to the internet. Coordinate with your team to review the plugin status and prepare for necessary updates or remediation steps to secure your API.

References

wpscan.com/vulnerability/dac80e74-ecfc-49e2-82a9-0c70285de1c1/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.