CVE-2026-116528
validatedZero produced an exploit or a check.description
Chargely Free Subscriptions for WooCommerce through version 1.0 exposes stored WooCommerce REST API credentials through an insufficiently protected REST endpoint. An unauthenticated remote attacker may obtain credentials that permit broad read and write access to the associated store.
mitigation
Deactivate the plugin or block public access to its affected REST endpoint until an authorization fix is available. Rotate WooCommerce REST API consumer keys and secrets that may have been exposed.
outcome
Differential: the exploit fired on the vulnerable build and stayed silent on the patched one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-11-14 06:00Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-116528
{ "etk_id": "ETK-2026-4447", "cve_id": "CVE-2026-116528", "display_id": "CVE-2026-116528", "ghsa_id": null, "euvd_id": "EUVD-2026-125857", "status": "published", "anchor_state": "anchored", "title": "Unauthenticated credential disclosure in Chargely Free Subscriptions", "summary": "Chargely Free Subscriptions for WooCommerce through version 1.0 exposes stored WooCommerce REST API credentials through an insufficiently protected REST endpoint. An unauthenticated remote attacker may obtain credentials that permit broad read and write access to the associated store.", "mitigation": "Deactivate the plugin or block public access to its affected REST endpoint until an authorization fix is available. Rotate WooCommerce REST API consumer keys and secrets that may have been exposed.", "vendor": null, "product": "Chargely Free Subscriptions For Woocommernce", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 1.0" ], "ecosystem": null, "fixed_versions": [], "package_name": "Chargely Free Subscriptions For Woocommernce", "purl": null } ], "cwes": null, "cvss_score": null, "cvss_src": null, "cvss_vector": null, "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "differential", "exploit": true, "pipeline_minutes": 17.574555883333332, "t0_at": "2026-11-14T06:00:06.339000+00:00", "signals": { "check": { "at": "2026-11-14T06:59:46.872645+00:00", "days": 0.041441361631944444, "is_lower_bound": false, "measured_at": "2026-11-14T06:00:06.339000+00:00", "url": null }, "exploit": { "at": "2026-11-14T06:59:46.872645+00:00", "days": 0.041441361631944444, "is_lower_bound": false, "measured_at": "2026-11-14T06:00:06.339000+00:00", "url": null }, "trigger_signal": { "at": "2026-11-14T06:00:06.339000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-11-14T06:00:06.339000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-116528" } } }
published 2026-11-14 06:42Z
last change 2026-11-14 07:41Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.