CVE-2026-7529: wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API
The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with permissioncallback => 'returntrue' in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin's banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wphandleupload() — without any nonce or capability check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress wiseCampaign – WooCommerce Conversions Made Easyto a version that resolves this vulnerability.Fixed in 1.1.16Patch wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API - Configuration
Update the plugin so REST API endpoints do not use permission_callback => '__return_true'; require an appropriate authorization check (e.g., nonce/capability verification) before allowing unauthenticated users to read/modify banner, stockbar, and core settings or upload background-image files.
wiseCampaign – WooCommerce Conversions Made Easy plugin (REST API endpoints) permission_callback = __return_true (should not be used)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7529?
CVE-2026-7529 has a severity rating of high with a score of 7.5.
How do I fix CVE-2026-7529?
To fix CVE-2026-7529, update the wiseCampaign plugin to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-7529?
CVE-2026-7529 is a vulnerability in the wiseCampaign plugin that allows unauthorized modification of plugin configurations via the REST API.
What versions of wiseCampaign are affected by CVE-2026-7529?
CVE-2026-7529 affects all versions of the wiseCampaign plugin up to and including 1.1.16.
What impacts does CVE-2026-7529 have on users?
CVE-2026-7529 could lead to unauthorized data disclosure and modification due to the lack of proper authorization for API endpoints.