ActiveTrail for WooCommerce

ActiveTrail for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for ActiveTrail for WooCommerce has a vendor fix available, so running the current release closes it.

All of these findings were reported by Ryan Fabella. ActiveTrail for WooCommerce is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.10.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all ActiveTrail for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-106028

ActiveTrail for WooCommerce <= 1.2.6 - Missing Authorization

Read the full analysis

Vulnerability Records

1 records
ActiveTrail for WooCommerce banner
Latestv1.2.8

ActiveTrail for WooCommerce

ActiveTrail

Author

ActiveTrail

5.0(1)
100/100
Last Updated
2026-10-13 (11d ago)
Active Installs
10+
Downloads
1,459
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 6.9.10
Created
2026-01-13 (9mo ago)
Requires Plugins
woocommerce

ActiveTrail for WooCommerce is an integration plugin that enables a simple and efficient connection between a WooCommerce store and the ActiveTrail platform. The plugin allows synchronizing core store data from WooCommerce to ActiveTrail, including contacts, orders, products, and site activity events. It supports both historical synchronization of existing data and online (real-time) synchronization of new data. The connection is established using an API key from the site owner’s ActiveTrail account and is configured through the WordPress admin interface. No additional development is required. Key Features Order and Subscriber Synchronization Automatic synchronization of orders and subscribers from the website to ActiveTrail Transfer of customer data, order details, and activity events Synchronization respects the user’s marketing consent status based on data stored on the site Marketing Consent Management Add marketing consent checkboxes to the checkout page Add marketing consent checkboxes to registration forms Store and validate consent status using user metadata fields Historical Synchronization Historical synchronization of existing contacts Option to synchronize contacts only or contacts together with orders Automatic scanning of commonly used metadata fields to verify previously given marketing consent Cart Abandonment Tracking Detection and tracking of abandoned carts on the site Sending abandoned cart data to ActiveTrail Cart tracking applies to registered users only Dynamic Product Catalog Generation Generation of product catalogs in XML format for: Facebook Catalog Google Merchant Center Catalogs are updated automatically in real time when products are added, updated, or deleted Privacy Policy ActiveTrail for WooCommerce transfers data via API to the site owner’s ActiveTrail account in order to synchronize information between WooCommerce and ActiveTrail. The plugin respects the user’s marketing consent status. The data sent to ActiveTrail may include: – Information submitted through registration forms – Information submitted during order checkout – Shopping cart data in cases of cart abandonment, for registered users only Third-party Services This plugin integrates with the ActiveTrail platform. Service provider: ActiveTrail Purpose: Synchronization of contacts, orders, cart data, and generation of product catalogs via API Relevant policies: – Anti-Spam Policy: https://www.activetrail.com/anti_spam_policy/ – Privacy Policy: https://www.activetrail.com/privacy_policy/ – Data Processing Agreement (DPA): https://www.activetrail.com/dpa/ – Terms and Conditions: https://www.activetrail.com/terms-and-conditions/ – ISO 27001 Certification: https://www.activetrail.com/iso-27001/

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C