CVE-2026-116528: Chargely Free Subscriptions <= 1.0 - Unauthenticated WooCommerce REST API Credential Disclosure
The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the affected plugin through version 1.0 are exposed if the vulnerable REST API route is reachable. No authentication is required to retrieve the stored WooCommerce API credentials.
What could an attacker do with the disclosed credentials?
The exposed consumer key and secret provide read and write access to the entire WooCommerce store. An attacker only needs to request the unprotected REST API route to obtain them.
How can I determine whether my store may already be affected?
Check whether Chargely Free Subscriptions For Woocommernce version 1.0 or earlier is installed and whether its WooCommerce REST API consumer key and secret are stored in the plugin configuration. If so, treat those credentials as potentially exposed.
What should be done if the credentials may have been exposed?
Rotate the WooCommerce REST API consumer key and secret held by the plugin, since previously retrieved credentials may remain usable. Also remove or otherwise prevent access to the unauthenticated route until a corrected plugin version is available.