CVE-2026-103323: Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Integration for Epos Now and WooCommerce WordPress pluginto a version that resolves this vulnerability.Fixed in 4.11.2
Event History
Frequently Asked Questions
Which deployments are most exposed to password disclosure?
Sites using the affected plugin with WooCommerce's deferred emails feature enabled are at risk of exposing plaintext passwords for newly registered customers through scheduled task arguments. Other exposed task data can include order identifiers.
Does an attacker need an account or other authorization to retrieve the queue data?
No. The affected REST endpoint lacks an authorization check, so unauthenticated users can retrieve scheduled background tasks and their arguments.
How can I determine whether my site is affected?
Check whether the Integration for Epos Now and WooCommerce plugin version is earlier than 4.11.2. Also determine whether WooCommerce deferred emails is enabled, as this affects whether newly registered customer passwords may be present in exposed task arguments.