wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce <= 1.2.2 - Missing Authorization to Sensitive Information Disclosure

Summary

The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX endpoint. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive information including user emails, usernames, roles, capabilities, and WooCommerce data such as products and payment methods.

Timeline

1. Nov 18, 2025, 9:27 AM UTCCVE published
2. Nov 18, 2025, 9:10 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Apr 8, 2026, 5:10 PM UTCRecord last updated

Affected versions

• sundayfanz wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce

  through 1.2.2

References 5