Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

ShopMagic plugin may expose sensitive customer data

CVE-2026-114195 · published 13 days ago
Summary

The ShopMagic extension for WooCommerce, up to version 4.9.1, can place private information in a location that anyone on the internet can reach. This could let attackers view details such as customer names, addresses, or payment information. Update the plugin to the latest version or remove it if you do not need the functionality.

What to do
  • Update wp desk shopmagic to version 4.9.2.
Affected software
VendorProductAffected versions
wp desk shopmagic <= 4.9.1
Fix: upgrade to 4.9.2
Original advisory text
WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory
Timeline
Published22 Oct 2026
Updated3 Nov 2026
First seen22 Oct 2026
Sources
CVE-2026-114195 · NVD
CVE-2026-114195 · MITRE
Track software like this
Free during beta