CVE-2026-106608

WooCommerce, Automattic’s WordPress e-commerce plugin, has an incorrect privilege assignment flaw (CWE-266) in versions 9.8.0 through 11.1.2 that allows privilege escalation. A remote attacker who already has high privileges can trigger it over the network with low complexity and no user interaction. Successful exploitation can fully affect confidentiality, integrity, and availability of the site (CVSS 3.1 base score 7.2, high). Stores running WooCommerce in that version range are affected; builds before 9.8.0 and after 11.1.2 are outside the stated range. No public proof of concept is known and the CVE is not in CISA’s Known Exploited Vulnerabilities catalog, so exploitation is not known to be occurring in the wild.

What to do: Update WooCommerce to a release newer than 11.1.2 as soon as Automattic publishes a fix, and confirm the running version is outside 9.8.0–11.1.2. Until then, limit administrator and shop-manager accounts to trusted people, review recent role and capability changes, and watch for unexpected privilege grants.