PrintAura WooCommerce plugin: Authentication bypass in WooCommerce REST API
Summary
The PrintAura WooCommerce WordPress plugin through version 4.0.2 does not properly restrict access to the WooCommerce REST API. Every WooCommerce REST route accepts unauthenticated requests. An unauthenticated remote attacker can read and modify store data, including customer orders and personal information, store and payment settings, and webhooks, without any user interaction.
Affected
- PrintAura Printaura-Woocommerce WordPress plugin, versions 0 through 4.0.2
- Unknown: exact vendor version list and default configuration
Fixed in
Unknown. No vendor advisory or confirmed fixed version was found at the time of writing. An unverified third-party source suggests version 4.0.3 or later, but this is not confirmed.
Workaround
- Check whether the plugin is installed and which version is active. If it is not needed, deactivate and remove it.
- Restrict access to the WooCommerce REST API (/wp-json/wc/...) at the web server or WAF to known IP addresses. Test first, because the PrintAura integration may need access.
- Review webhooks, payment and store settings, and recent orders and customer records for unexpected changes.
Exploitation
- No evidence of exploitation in the wild found. Not listed in CISA KEV at the time of writing.
- No public proof-of-concept or exploit found in Metasploit or Exploit-DB as of 10 Nov 2026.
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Inventory all WooCommerce sites and check whether this plugin is installed and at which version.
- Apply the workarounds immediately, because no confirmed fix exists yet.
- Rotate WooCommerce REST API keys, webhook secrets and PrintAura credentials if exposure cannot be ruled out.
- Review logs and store data for unexpected access or changes.
- Check the WPScan entry and the plugin changelog daily until a fixed version is confirmed, then update promptly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- CVE Record CVE-2026-115733 www.cve.org
- VulDB CVE-2026-115733 vuldb.com
- OffSeq threat radar CVE-2026-115733 radar.offseq.com
- PrintAura WooCommerce plugin GitHub repository github.com
- PrintAura WooCommerce integration tutorial blog.printaura.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:23.
Original description (NVD)
The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.