MgoSync Plugin Bug Exposes WooCommerce API Keys

If your WooCommerce store runs the MgoSync plugin older than version 2.1.7, update it now, then replace your WooCommerce API keys, because anyone on the internet may be able to read them.

This post is for owners and managers of WooCommerce stores that use MgoSync. You will get a plain-English explanation of the flaw, a quick way to check if you are affected, and a step-by-step cleanup. No security background needed.

What is the MgoSync vulnerability?

The flaw is tracked as CVE-2026-92404. (A CVE is a public ID number for a known security bug, so everyone can talk about the same problem.) The National Vulnerability Database (NVD) published it on 2026-09-19. You can read the official record on the NVD page for CVE-2026-92404.

Here is the short version, in our own words. MgoSync adds a REST API endpoint to your WordPress site. (A REST API endpoint is a web address that software can call to get or send data.) In versions before 2.1.7, one of those endpoints does not check who is asking. A stranger with no login can ask it for the WooCommerce API credentials stored on your site.

Those credentials include a consumer key and consumer secret with read/write access. Think of them as a username and password that other software uses to talk to your store.

The NVD lists the weakness as CWE-200, which means exposure of sensitive information to someone who should not see it. The CWE-200 entry explains the category.

How serious is it?

The NVD scores it High, 7.5 out of 10 (CVSS 3.1). CVSS is a standard scoring system for bug severity. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N breaks down like this:

• Network, low complexity: it can be attempted over the internet, with no special tricks.
• No privileges, no user interaction: the attacker needs no account, and no one has to click anything.
• Confidentiality high: the main damage is that secret information gets read.
• Integrity and availability none: the plugin bug itself does not change data or take the site down.

That last part needs context. The score rates what the bug does by itself. But the secret it leaks is a read/write key. If someone gets that key, they may be able to use it against your store's WooCommerce API, which can include reading customer and order data and making changes, depending on what your store exposes. So treat this as more than a simple information leak.

Two honest notes. First, the NVD entry is marked Deferred, which means NVD has not fully analyzed it yet, so details may be refined later. Second, the NVD does not say whether anyone is attacking this in the wild, and we won't guess. The sensible move is to act as if the keys could have been read.

Who is affected?

You are affected if both of these are true:

1. Your site uses the MgoSync WordPress plugin at a version before 2.1.7.
2. The plugin is set up with WooCommerce credentials on your site. The NVD says the issue lets people retrieve credentials "from a configured site," so a plugin that is installed but never configured holds less to steal.

The NVD record does not list affected versions separately. The description says "before 2.1.7," so that is the line we use. Version 2.1.7 or newer is the fixed range according to that description. The WPScan entry listed as a reference is another place to check details.

How to check your version

Pick whichever is easiest.

In the WordPress dashboard:

1. Log in to yoursite.com/wp-admin.
2. Go to Plugins > Installed Plugins.
3. Find MgoSync and read the version number under its name.

With WP-CLI (if you or your host use the command line):

wp plugin list --fields=name,status,version,update

Look for the MgoSync row. If update says available, you are behind.

What to do, in the right order

Order matters here. If you change your keys first and the plugin is still leaky, the new keys can leak too.

1. Back up your site. Use your host's backup tool or your usual backup plugin. This takes a few minutes and gives you a safe way back.
2. Update MgoSync to 2.1.7 or newer. In the dashboard, go to Plugins > Installed Plugins and click Update now. With WP-CLI, run wp plugin update 'PLUGIN-SLUG-HERE', and replace PLUGIN-SLUG-HERE with the slug shown in the name column of wp plugin list. Check the plugin's changelog if you want to confirm the fix is listed.
3. If you cannot update right away, deactivate the plugin. Go to Plugins > Installed Plugins and click Deactivate. A switched-off plugin does not serve its endpoints. Do this until you can update.
4. Replace your WooCommerce API keys. See the next section.
5. Review recent activity. See "How to look for signs of misuse" below.

How to replace your WooCommerce API keys

WooCommerce lets you revoke (cancel) a key and create a new one. Here is the path:

1. Go to WooCommerce > Settings > Advanced > REST API.
2. Look at the list of keys. Note the Description, Permissions (Read, Write, or Read/Write) and Last access date for each. Before you revoke anything, write down or screenshot each key's Last access date. You need it for the misuse check below, and a revoked key is deleted, so the date will be gone.
3. Revoke the key that MgoSync uses. If you are not sure which one, revoke every Read/Write key you do not recognize. Click Revoke key under the key.
4. Click Add key, give it a clear description (for example, MgoSync 2026-10), choose the user, pick the least access that works, and click Generate API key.
5. Copy the new consumer key and secret right away. WooCommerce shows the secret only once.
6. Paste the new values into MgoSync's settings and into any other tool that used the old key.

Revoking a key will break anything still using the old one. That is the point, but expect to reconnect your integrations. WooCommerce explains how its API keys work in its REST API documentation.

If MgoSync only needs to read data, give it a Read key. Smaller permissions mean a smaller mess if a key ever leaks again.

How to look for signs of misuse

You can't prove nothing happened, but you can look for clues.

• Check the "Last access" dates you wrote down for the old keys before revoking them (they were listed under WooCommerce > Settings > Advanced > REST API). A date that does not match your own use is worth a closer look. Last access shows only the most recent use, so normal traffic from your own integrations can overwrite a suspicious entry. A clean-looking date is not proof that nothing happened.
• Scan your orders, products and customers for changes you did not make: edited prices, new admin-type users, odd coupons, or unfamiliar orders.
• Search your server's access log for requests to the plugin. On many Linux servers, this is a start: grep -i 'wp-json' /var/log/nginx/access.log | grep -i mgosync (the path varies by host, and Apache uses /var/log/apache2/access.log). The NVD record does not name the endpoint's route, so finding nothing for "mgosync" does not rule out access. Also look through requests to /wp-json/ from IP addresses you do not recognize. Many hosts also let you download logs from their control panel.
• Ask your host if you cannot reach the logs.

No suspicious signs does not mean you were safe, since logs may rotate and be deleted. That is why rotating the keys matters even when everything looks normal.

If you do find signs of a break-in, follow our website hacked guide for next steps.

Quick decision table

Why plugin bugs like this keep happening

This bug is a missing permission check. The endpoint worked fine for the right person, but nobody told it to turn away everyone else. The OWASP REST Security Cheat Sheet lists access control on every endpoint as a basic requirement.

You can't read every plugin's code, but you can lower your risk:

• Remove plugins you don't use. Deactivated plugins still sit on your server.
• Turn on automatic updates for plugins you trust, or set a weekly reminder to update.
• Give each integration its own WooCommerce key with the least permission it needs.
• Check the Last access date on your keys from time to time.

For a wider look at your exposure, read Is my website hackable?. You can also run our free website security check for a quick passive look at your site from the outside.

Key takeaways

• MgoSync before 2.1.7 has a missing-authorization bug (CVE-2026-92404, CVSS 7.5 High) that can let anyone read your stored WooCommerce API credentials.
• The leaked credentials include a read/write consumer key and secret, so treat them as exposed.
• Update MgoSync to 2.1.7 or newer first. If you can't, deactivate it.
• After patching, revoke and recreate your keys under WooCommerce > Settings > Advanced > REST API, with the least permission needed. Write down each key's Last access date before you revoke it.
• Review orders, users and the Last access dates you saved for anything you didn't do, and remember a clean-looking date is not proof that nothing happened.

Want a human to check the rest?

One plugin bug is one door. A person can look at the other doors. Our $49 Circuit audit is a manual review of your whole site by a security engineer, with a written report of every issue, its severity, evidence and exact fixes. It is a focused small-site audit, not a compliance certificate or a multi-week enterprise pentest. See pricing to compare options, or start with the free check above.