CVE-2026-115733: PrintAura WooCommerce API <= 4.0.2 - Unauthenticated WooCommerce REST API Authentication Bypass
The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Stores using the PrintAura Printaura-Woocommerce WordPress plugin version 4.0.2 or earlier are affected. The issue exposes WooCommerce REST API routes.
Does exploitation require an account or valid credentials?
No. The affected routes accept unauthenticated requests, so an attacker does not need WooCommerce or WordPress credentials.
What could an attacker access or change?
An attacker can read and modify store data, including customer orders and personal information, store and payment settings, and webhooks.
Is there public exploit evidence?
Yes. The vulnerability is flagged as having a proof of concept.