{"api_version":"1","generated_at":"2026-11-14T23:50:28+00:00","cve":"CVE-2026-116528","urls":{"html":"https://cve.report/CVE-2026-116528","api":"https://cve.report/api/cve/CVE-2026-116528.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-116528","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-116528"},"summary":{"title":"Chargely Free Subscriptions <= 1.0 - Unauthenticated WooCommerce REST API Credential Disclosure","description":"The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-14 07:17:17","updated_at":"2026-11-14 07:17:17"},"problem_types":["CWE-200 Information Exposure"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/423af746-a5a6-4eb5-a4ac-dcd0396882d4/","name":"https://wpscan.com/vulnerability/423af746-a5a6-4eb5-a4ac-dcd0396882d4/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116528","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116528","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"Chargely Free Subscriptions For Woocommernce","version":"affected 1.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Naoki Kawahigashi","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"Chargely Free Subscriptions For Woocommernce","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Naoki Kawahigashi"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store."}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-14T06:00:06.339Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/423af746-a5a6-4eb5-a4ac-dcd0396882d4/"}],"source":{"discovery":"EXTERNAL"},"title":"Chargely Free Subscriptions <= 1.0 - Unauthenticated WooCommerce REST API Credential Disclosure","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-116528","datePublished":"2026-11-14T06:00:06.339Z","dateReserved":"2026-10-26T14:14:39.932Z","dateUpdated":"2026-11-14T06:00:06.339Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-14 07:17:17","lastModifiedDate":"2026-11-14 07:17:17","problem_types":["CWE-200 Information Exposure"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"116528","Ordinal":"1","Title":"Chargely Free Subscriptions <= 1.0 - Unauthenticated WooCommerce","CVE":"CVE-2026-116528","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"116528","Ordinal":"1","NoteData":"The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store.","Type":"Description","Title":"Chargely Free Subscriptions <= 1.0 - Unauthenticated WooCommerce"}]}}}