CVE-2026-11568

Name of the Vulnerable Software and Affected Versions Product Configurator for WooCommerce versions prior to 1.7.3

Description The plugin fails to perform authorization or post-status checks before returning product data through a public AJAX action. This allows unauthenticated users to bypass WordPress post-visibility controls and retrieve sensitive information—including title, price, weight, stock status, and configurator option pricing/SKUs—of private and draft products by providing the product ID via the pc get data action.

Recommendations Update Product Configurator for WooCommerce to version 1.7.3 or later.