CVE-2026-7529 wisemattic CVE debrief

Who should care

WordPress users with the wiseCampaign plugin installed, security teams monitoring WordPress vulnerabilities, developers responsible for maintaining WordPress plugins, and operators managing affected systems should be aware of this vulnerability and take necessary actions to protect against unauthorized data access and modification. This includes reviewing and updating the plugin to version 1.1.17 or later, restricting access to the plugin's REST API endpoints, and monitoring plugin activity for unauthorized changes. Additionally, affected organizations should assess their exposure, implement compensating controls, and track exceptions and retest remediated assets.

Technical summary

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to its REST API endpoints being registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This allows unauthenticated attackers to read and modify plugin settings, including banner records, stockbar flags, and background-image files.

Defensive priority

High priority due to high CVSS score of 7.5 and potential for unauthorized data access and modification.

Recommended defensive actions

• Review and update the wiseCampaign plugin to version 1.1.17 or later.
• Restrict access to the plugin's REST API endpoints.
• Monitor plugin activity for unauthorized changes.
• Implement additional security measures to protect against unauthorized data access.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress has a security issue allowing unauthorized access and modification of plugin data. Evidence from the NVD and Wordfence indicates that the plugin's REST API endpoints are registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This allows unauthenticated attackers to read and modify plugin settings, including banner records, stockbar flags, and background-image files. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources