CVE-2026-11568

HIGH

Product Configurator for WooCommerce < 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc_get_data

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-11568. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-11568, an information leak vulnerability in the Product Configurator for WooCommerce WordPress plugin (before 1.7.3). The code includes placeholder methods (`check()` and `run()`) but lacks actual exploit implementation, referencing only a WPScan advisory.

Description

The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX action, allowing unauthenticated users to retrieve the data (title, price, weight, stock status, and configurator option pricing/SKUs) of private and draft, non-public products by supplying the product ID. WordPress post-visibility controls are bypassed.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-11568_the_product_configurator.py

This repository contains an auto-generated stub module for CVE-2026-11568, an information leak vulnerability in the Product Configurator for WooCommerce WordPress plugin (before 1.7.3). The code includes placeholder methods (`check()` and `run()`) but lacks actual exploit implementation, referencing only a WPScan advisory.

Classification
Stub 99%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Theoretical
Target: Product Configurator for WooCommerce WordPress plugin before 1.7.3
No auth needed
Prerequisites: Target must be running a vulnerable version of the plugin (<1.7.3) · Network access to the WordPress site (HTTP/HTTPS)
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit exploit vdb-entry technical-description
https://wpscan.com/vulnerability/e208fee5-dad5-4aeb-b9b5-fbd72a5633e4/

Scores

CVSS v3 7.5
EPSS 0.0028
EPSS Percentile 20.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

Status published
Products (1)
None/Product Configurator for WooCommerce < 1.7.3
Published Jul 01, 2026
Tracked Since Jul 01, 2026