What the vulnerability does
01Description
The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin's banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload() — without any nonce or capability check.
Explanation of Vulnerability in Simple Terms
02Summary
wiseCampaign versions up to 1.1.16 lack proper authorization checks, allowing unauthenticated attackers to modify campaign data and settings over the network. The vulnerability requires no user interaction and affects the integrity of stored campaign information. No confidentiality or availability impact is present. Update to a version newer than 1.1.16.
What an attacker can do
03Attacker Capabilities
Modify WooCommerce campaign data and settings without authentication.
Potential impact on your site
04Site Impact
Campaign configurations and conversion data can be altered by anyone on the internet.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 5, 2026
CVE published
August 5, 2026
Record updated
