CVE WatchOct 22, 2026

CVE-2026-114195

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce

CVSS

5.3

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 22, 2026 · Last modified: Oct 22, 2026 · CWE-538

EPSS · 30d

Not enough EPSS history yet.

Technical description

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.

Official references

patchstack.comhttps://patchstack.com/database/wordpress/plugin/shopmagic-for-woocommerce/vulnerability/wordpress-shopmagic-plugin-4-9-1-sensitive-data-exposure-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1120275.3 MED

25.6%

——8A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the argument filename results in file and directory information exposure. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.3d CVE-2026-1099704.7 MED

2.5%

——1A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.7d CVE-2026-969445.5 MED

38.7%

——12Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.7d CVE-2026-1089375.3 MED

24.7%

——7A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manipulation results in file and directory information exposure. It is possible to launch the attack remotely. The exploit is now public and may be used.7d CVE-2026-44828—

27.9%

——8Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.6d CVE-2026-57442—

8.4%

——3MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and node_modules path segments do not match the restriction and pass both isAllowed() and isAllowedForListing(). An attacker who influences a path selected by an AI agent can traverse nested repository or Obsidian metadata, read remote URLs or embedded tokens, or cause nested node_modules content to pollute the listAllTags index. This issue is fixed in version 0.11.5.36d