CVE-2026-14832: Unknown Shopsmart Loyalty For Woocommerce

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to unauthenticated users, allowing anyone who knows a customer's phone number to retrieve that customer's loyalty profile, including name, email, and account balance.

Affected products

• Unknown Shopsmart Loyalty For Woocommerce: up to and including 1.0.0

Published 2026-08-17. Last modified 2026-08-26.