CVE-2026-114195: WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Desk ShopMagic shopmagic-for-woocommerceto a version that resolves this vulnerability.Fixed in 4.9.2
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is remotely reachable and requires no authentication or user interaction, as indicated by the AV:N, PR:N, and UI:N vector components.
What is the potential impact?
An attacker may retrieve embedded sensitive data from an externally accessible file or directory. The reported impact is limited to confidentiality; integrity and availability are not affected.
Which ShopMagic versions are affected?
ShopMagic versions through 4.9.1 are affected. The available data does not identify a fixed version.