CVE-2026-7529wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API
Updated under an hour ago ()
Does this affect you?
It affects wisemattic wiseCampaign – WooCommerce Conversions Made Easy. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin's banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload() — without any nonce or capability check.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Wordfence
- NVD analysis
- Deferred
- Record last updated
- Aug 5, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
wisemattic wiseCampaign – WooCommerce Conversions Made Easy wisemattic:wisecampaign_woocommerce_conversions_made_easy (from the name) | through 1.1.16 | CNA record |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9a47e6ff-a1d2-40f0-b4d2-8ee8394ce603?source=cve
- https://plugins.trac.wordpress.org/browser/wisecampaign/trunk/includes/Classes/Banner.php#L50
- https://plugins.trac.wordpress.org/browser/wisecampaign/tags/1.1.16/includes/Classes/Banner.php#L50
- https://plugins.trac.wordpress.org/browser/wisecampaign/trunk/includes/Classes/WiseBannerV2.php#L105
- https://plugins.trac.wordpress.org/browser/wisecampaign/tags/1.1.16/includes/Classes/WiseBannerV2.php#L105
- https://plugins.trac.wordpress.org/browser/wisecampaign/trunk/includes/Classes/StockBar.php#L176
- https://plugins.trac.wordpress.org/browser/wisecampaign/tags/1.1.16/includes/Classes/StockBar.php#L176
- https://plugins.trac.wordpress.org/browser/wisecampaign/trunk/includes/Classes/Menu.php#L38
- https://plugins.trac.wordpress.org/browser/wisecampaign/tags/1.1.16/includes/Classes/Menu.php#L38
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3529781%40wisecampaign%2Ftrunk&old=3529780%40wisecampaign%2Ftrunk
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.