PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110367 WPExperts CVE debrief

PatchSiren debrief for CVE-2026-110367: The APIExperts Square for WooCommerce plugin, used in WordPress installations, has a Broken Access Control vulnerability (CVE-2026-110367) affecting versions up to 4.7.5. This medium-severity issue could allow unauthorized access due to missing authorization, potentially impacting e-commerce operations and customer data. Defenders should assess exposure and prioritize updates to prevent exploitation. The vulnerability's scope and severity indicate a need for prompt verification of plugin versions and access control configurations. Evidence from the CVE record and source item supports this assessment, highlighting the importance of updating to

Vendor
WPExperts
Product
APIExperts Square for WooCommerce
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-15
Advisory published
2026-10-15
Advisory updated
2026-10-15

Who should care

Defenders responsible for WordPress installations with the APIExperts Square for WooCommerce plugin should assess exposure and prioritize updates.

Why it matters

CVE-2026-110367 is a medium-severity vulnerability in the APIExperts Square for WooCommerce plugin. Defenders should prioritize verifying and updating plugin versions to prevent potential unauthorized access. The vulnerability affects WordPress installations with the plugin version up to 4.7.5.

  • Potential unauthorized access to sensitive data or functionality
  • Possible lateral movement within compromised WordPress environments
  • Need for verification of plugin version and access control configurations
  • Potential impact on e-commerce operations and customer data

Technical summary

The APIExperts Square for WooCommerce plugin, versions up to 4.7.5, contains a missing authorization vulnerability. This security flaw could allow attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized access. The issue affects WordPress installations using the plugin. To mitigate this vulnerability, defenders should verify and update the plugin to version 4.7.6 or later. The vulnerability's technical details indicate a need for review and adjustment of access control configurations for the plugin, as well

Defensive priority

Defenders should prioritize verifying and updating APIExperts Square for WooCommerce plugin versions to prevent potential unauthorized access.

Recommended defensive actions

  • Verify APIExperts Square for WooCommerce plugin version and update to 4.7.6 or later if necessary
  • Review and adjust access control configurations for the plugin
  • Monitor plugin usage and logs for potential unauthorized access attempts

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in APIExperts Square for WooCommerce plugin versions up to 4.7.5.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110367 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110367

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110367 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110367

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.