CVE-2026-90985 PUBLISHED

WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_load

Assigner: WPScan
Reserved: 14.09.2026 Published: 23.09.2026 Updated: 23.09.2026

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products.

Product Status

Vendor Unknown
Product WPC Smart Compare for WooCommerce
Versions Default: unaffected
  • affected from 0 to 6.6.1 (excl.)

Credits

  • Artus KG finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE