CVE-2026-11351

5.3 mediumEPSS 0.3%

Medium (5.3). EPSS 0.3% chance of exploitation in the next 30 days.

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-11-01)
CWE: CWE-200
Published: 2026-07-29
Modified: 2026-07-30
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/cac3a0c4-e6b9-42a6-b702-abcba67038c2/

Check your stack JSON