medium5.3
CVE-2026-11351
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated user…
Impact
The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.
Affected products
| Product | Affected versions |
|---|---|
| ShinyStat Analytics WordPress Plugin | before 1.0.17 |
Versions were read from the advisory text. No structured product data has been published for this record yet.