CVE-2026-27330 HIGH

CVE-2026-27330: WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Vendor Weptile
Product Mobile App for WooCommerce
Weakness CWE-862 · Missing authorization
Published August 27, 2026
Last update August 27, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Mobile App for WooCommerce fails to properly check user permissions before allowing access to sensitive functions. An attacker on the network can read and modify data without authentication. This affects all versions up to 0.4.62. Site owners should update immediately and review access logs for unauthorized activity.

What an attacker can do

03Attacker Capabilities

Read and modify WooCommerce data without logging in.

Potential impact on your site

04Site Impact

Unauthorized users can access and alter orders, customer data, and store settings.

Conditions required to exploit

05Prerequisites

Network access to the mobile app; no authentication required.

Key dates

06Disclosure timeline

August 27, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-81279 WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability CVE-2026-28571 WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability CVE-2026-66469 WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability CVE-2026-73403 WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability