CVE-2026-88929 PUBLISHED

Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure

Assigner: WPScan
Reserved: 10.09.2026 Published: 23.09.2026 Updated: 23.09.2026

The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.

Product Status

Vendor Unknown
Product Product Badge, Label, Countdown Timer for WooCommerce
Versions Default: unaffected
  • affected from 7.0.0 to 7.5.2 (excl.)

Credits

  • Que Thanh Tuan finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE