Is CVE-2026-92404 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92404?

CVE-2026-92404 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-92404

Description

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.