CVE-2026-11351

UNKNOWN 0.0

ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve information about non-published (e.g. draft, pending or private) WooCommerce products.

Vendor	unknown
Product	shinystat analytics
Published	Jul 29, 2026

Stay Ahead of the Next One

Get instant alerts for unknown shinystat analytics

Be the first to know when new unknown vulnerabilities affecting unknown shinystat analytics are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / ShinyStat Analytics

1.0.12 < 1.0.17

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/cac3a0c4-e6b9-42a6-b702-abcba67038c2/

Credits

Que Thanh Tuan WPScan