CVE-2026-116528
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 14, 2026
Vendor
unknown
Description
The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check on a REST API route that returns its stored configuration, allowing unauthenticated attackers to retrieve the live WooCommerce REST API consumer key and secret it holds, which grant read and write access to the whole store.