The MgoSync WordPress plugin is vulnerable to an unauthenticated information disclosure flaw that allows remote attackers to access sensitive WooCommerce API keys.

The plugin fails to implement necessary authorization checks on a specific REST API endpoint. This allows any unauthenticated user to query the endpoint and retrieve stored WooCommerce consumer keys and secrets.

The exposure of WooCommerce API credentials grants an attacker full read and write access to the associated store's backend. This could lead to the theft of customer data, unauthorized modification of product pricing, or financial fraud. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to the integrity and confidentiality of e-commerce operations.

Immediate Action: Update the MgoSync plugin to version 2.1.7 or later immediately to apply the necessary authorization controls.

Proactive Monitoring: Monitor server access logs for unusual requests directed toward the plugin's REST API endpoints, specifically looking for repeated attempts to access configuration paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to block unauthorized access to the specific REST API paths associated with the MgoSync plugin until the update is applied.

Public Exploit Available: No

Organizations utilizing the MgoSync plugin must prioritize this update to prevent unauthorized access to their store infrastructure. Because this vulnerability allows for the total compromise of WooCommerce credentials without requiring any user interaction, the patch should be applied during the current maintenance cycle to mitigate the risk of data exfiltration and financial impact.