PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-114195 WP Desk CVE debrief

The CVE-2026-114195 vulnerability affects the WordPress ShopMagic plugin, versions up to and including 4.9.1. This issue is related to sensitive data exposure due to the insertion of sensitive information into externally accessible files or directories. The vulnerability allows Retrieve Embedded Sensitive Data. Defenders need to verify the version of the ShopMagic plugin in use and update to version 4.9.2 or later if necessary. They should also review and monitor the plugin's configuration and usage to prevent sensitive data exposure.

Vendor
WP Desk
Product
ShopMagic
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for WordPress installations using the ShopMagic plugin should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

The CVE-2026-114195 vulnerability affects the WordPress ShopMagic plugin, versions up to and including 4.9.1, and is related to sensitive data exposure.

  • Defenders need to verify the version of the ShopMagic plugin in use and update to version 4.9.2 or later if necessary.
  • Defenders should review and monitor the plugin's configuration and usage to prevent sensitive data exposure.

Technical summary

The ShopMagic plugin for WordPress, versions up to and including 4.9.1, is vulnerable to sensitive data exposure due to the insertion of sensitive information into externally accessible files or directories. This allows Retrieve Embedded Sensitive Data. The vulnerability affects WordPress installations using the ShopMagic plugin. Defenders should prioritize verifying the version of the ShopMagic plugin in use and updating to version 4.9.2 or later if necessary. They should also review and monitor the plugin's configuration and usage to prevent sensitive data and

Defensive priority

Defenders should prioritize verifying the version of the ShopMagic plugin in use and updating to version 4.9.2 or later if necessary.

Recommended defensive actions

  • Verify the version of the ShopMagic plugin in use
  • Update to version 4.9.2 or later if necessary
  • Review and monitor the plugin's configuration and usage

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. The ShopMagic plugin for WordPress, versions up to and including 4.9.1, is vulnerable to sensitive data exposure. The official CVE Program record and NIST NVD detail page provide additional information about the vulnerability. Defenders should verify the version of the ShopMagic plugin in use and update to version 4.9.2 or later if necessary. They should also review

Sources and references

Verified primary and authoritative sources

  • CVE-2026-114195 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-114195

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-114195 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-114195

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.