The vulnerability exists in the MgoSync WordPress plugin prior to version 2.1.7. An unauthenticated REST API endpoint does not enforce authorization, allowing any visitor to retrieve stored WooCommerce API credentials, including the consumer key and secret used for read/write access. This disclosure permits an attacker to control a WooCommerce store via the API, potentially manipulating products, orders, and private data.

Any WordPress site running MgoSync before version 2.1.7 is affected. The issue specifically impacts the REST endpoint that exposes WooCommerce API credentials, regardless of other plugins or themes on the site.

Based on the description, the attacker can simply access the endpoint without any authentication. Because no authorization check is performed, the exploitation is trivial if the endpoint is reachable. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The potential impact lies mainly in confidentiality and integrity, as the exposed credentials grant full API access to the store.