CVE-2026-7529

Name of the Vulnerable Software and Affected Versions wiseCampaign – WooCommerce Conversions Made Easy versions prior to 1.1.17

Description The plugin is susceptible to unauthorized data disclosure and modification because all REST API endpoints are registered with permission callback => ' return true', which bypasses necessary authorization. This allows unauthenticated attackers to read and modify core settings, stockbar configurations, and banner records. Additionally, attackers can toggle feature flags, change the active banner, and upload background-image files using the wp handle upload() function without providing a nonce or passing a capability check.

Recommendations Update the plugin to a version later than 1.1.16.