Vulnerabilities

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 4.1.23. Its PermissionManager::manage_permissions() function, hooked to WordPress core's map_meta_cap filter, unconditionally returns the always-true 'exist' primitive for every capability check whenever the evaluated user ID is 1, without scoping this to plugin-specific capabilities. An authenticated attacker who controls the site's user ID 1 account — even one demoted to Subscriber, a common administrator-account hardening practice — can therefore pass every capability check, including manage_options, edit_plugins, edit_themes, promote_users, and update_core, gaining administrator-equivalent power, full site takeover, and remote code execution via the plugin and theme editors. On default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs, which explains the High attack-complexity CVSS 3.1 score of 7.5. No public proof of concept is known and the flaw is not listed in CISA's KEV catalog, so exploitation is currently considered none known.

Do: Update Eventin to a version newer than 4.1.23 (the latest release) as soon as possible. If you use the 'demote user ID 1' hardening pattern, audit that account for signs of compromise and enforce a strong password plus two-factor authentication until patched. As a defense-in-depth measure against the plugin/theme editor RCE path, define DISALLOW_FILE_EDIT in wp-config.php.

Alior Bank's 'raty' installment-payment module for PrestaShop contains a SQL injection flaw (CVSS 4.0: 8.6) in the hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter hook methods, which run when a product or category is saved in the backoffice. The module inserts the POST parameters alior_product_promotion, alior_category_promotion, and alior_category_enabled directly into SQL UPDATE queries with no sanitization or validation. An attacker with access to the product or category add/edit functionality — for example a low-privilege employee account with catalog permissions — can inject arbitrary SQL and read or modify database contents, including customer, order, and administrative data. Affected deployments are PrestaShop shops running the module in versions prior to 8.1.11 or 9.0.7, most plausibly merchants in Poland offering Alior Bank installment payments. No public proof of concept or in-the-wild exploitation is known, and the issue is not listed in the CISA KEV catalog.

Do: Update the raty module to 9.0.7 or 8.1.11, matching the version line you run, and disable or remove the module until the patch is applied. Restrict backoffice rights to add or edit products and categories to trusted staff, since that level of access is required to trigger the injection. Review database audit logs, admin accounts, and catalog records for signs of unexpected UPDATE queries or unauthorized data changes.

The Alior Bank 'raty' installment module for PrestaShop (distributed to the bank's commercial partners) contains a SQL injection flaw in its toggleCategoryPromotionAction method, where the raw value of the POST parameter 'status' is inserted into SQL UPDATE queries without any sanitization or validation. An attacker who already has access to product or category add/edit functionality in the PrestaShop backoffice can submit a crafted 'status' value to inject and execute arbitrary SQL. Successful exploitation allows unauthorized reading and modification of the shop's database contents, including sensitive customer and order data, which is reflected in a CVSS 4.0 score of 8.6 (high). Affected sites are PrestaShop stores running this module, which is only offered to Alior Bank commercial partners — predominantly Polish merchants offering Alior installment payments. No public proof of concept exists and no exploitation in the wild has been reported; the CVE is not listed in CISA's KEV catalog.

Do: Contact Alior Bank for a patched version of the 'raty' module and apply it as soon as one is released; if the installment feature is not needed, disable or remove the module in the meantime. Restrict PrestaShop backoffice permissions so that only fully trusted employees can add or edit products and categories, since the flaw requires that level of access. Review database and application logs for anomalous UPDATE queries or unexpected data changes originating from the module's promotion-toggle action.

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin for WordPress is affected by an unrestricted file-upload flaw (CWE-434): the mipl_wc_upload_file function performs no file-type validation in all versions up to and including 1.2.1. An unauthenticated, remote attacker can trigger the flaw by submitting a crafted upload request over the network, with no authentication or user interaction required (CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N). By uploading arbitrary files — for example a PHP script — to a web-executable location, the attacker may achieve remote code execution and compromise the site, matching the high confidentiality, integrity, and availability impact reflected in the critical 9.8 score. Any WordPress site, typically a WooCommerce store, running the plugin at version 1.2.1 or older is affected. As of the available data there is no public proof-of-concept, the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

Do: Update the plugin to the first available release newer than 1.2.1 once a patched version is published (no fixed version number is stated in the available data), or deactivate the plugin until a fix ships. As an interim mitigation, deny PHP execution in the upload destination used by the plugin (typically under wp-content/uploads) via web-server rules so uploaded files cannot run. Because the flaw is exploitable by unauthenticated users on internet-facing stores, check the uploads directory for unexpected PHP or other unfamiliar files and review web-server logs for unauthenticated POST requests to the plugin's upload endpoint.

CVE-2026-81799 is a broken access control vulnerability (missing authorization, CWE-862) in the Return Refund and Exchange For WooCommerce WordPress plugin, affecting all versions up to and including 4.6.4. A privileged action in the plugin lacks a proper authorization check, so any unauthenticated visitor can trigger it over the network with no privileges or user interaction required. An attacker who does this can modify data managed by the plugin — plausibly return, refund, and exchange (RMA) request information — and the CVSS score (C:N/I:H/A:N) indicates integrity-only impact with no confidentiality loss or service disruption. Any WordPress/WooCommerce store running the plugin at version 4.6.4 or older is affected; sites without the plugin are not. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and no in-the-wild exploitation is known.

Do: Update Return Refund and Exchange For WooCommerce to the latest patched release (any version newer than 4.6.4). Until patched, deactivate the plugin or restrict unauthenticated access to its AJAX/REST endpoints, and review logs and existing return/refund/exchange records for signs of tampering. Since there is no public PoC or known exploitation yet, patching at the next maintenance cycle is reasonable unless the store is heavily exposed.

CVE-2026-81794 is a broken access control flaw (CWE-862, missing authorization) in the Shirt Product Designer for WooCommerce WordPress plugin, in which a privileged action is reachable without any authentication check. An unauthenticated attacker triggers it by sending a crafted network request directly to the affected endpoint, since the code performs the action without verifying user privileges or intent. Per the CVSS vector (Network, Low complexity, No privileges, No user interaction, Integrity impact High), a successful attack lets the attacker modify data on the site, such as plugin or store data, without reading or disrupting it. Any WordPress/WooCommerce site running the disclosed affected version (1.0.4) of the plugin is in scope; the available data does not specify the exact fixed release. There is no public proof of concept, the CVE is not in CISA's KEV, and no exploitation has been observed to date.

Do: Update Shirt Product Designer for WooCommerce to the latest patched release as soon as one is published, and check the vendor/WordPress.org changelog for the fixed version number. Until patched, consider disabling the plugin if it is not essential, or blocking unauthenticated requests to the plugin's endpoints via a WAF or web server rules. Review the site for unexplained modifications to product, order, or plugin settings, since the flaw's primary impact is unauthorized data changes.

CVE-2026-81789 is an unauthenticated arbitrary file deletion vulnerability (path traversal, CWE-22) in the Advanced Product Fields Extended for WooCommerce WordPress plugin, affecting all versions up to and including 3.1.6. Because the vulnerable code is reachable through network-facing WooCommerce/plugin endpoints without requiring a login, a remote attacker can submit traversal paths that cause the plugin to delete an arbitrary file on the server. The immediate impact is to site availability, which the CVSS 8.6 score reflects (high availability impact, changed scope), and in WordPress, removal of critical files such as wp-config.php can additionally open the door to full site compromise, though no published exploit chain describes that escalation. Any WordPress site running the plugin at version 3.1.6 or earlier as part of a WooCommerce store is affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known.

Do: Update Advanced Product Fields Extended for WooCommerce to the newest release (any version above 3.1.6) as soon as practical. As an interim mitigation, block or rate-limit unauthenticated requests to the plugin's endpoints at the WAF and verify the integrity of core files such as wp-config.php if you suspect tampering. Because no public PoC exists yet, patching now closes the window before exploit details typically emerge.

CVE-2026-81786 is a missing-authorization flaw (CWE-862) in the Thank You Page Customizer for WooCommerce WordPress plugin, allowing an unauthenticated attacker to invoke a restricted function without any login or user interaction. It is triggered by sending a crafted, unauthenticated HTTP request to the vulnerable routine on any site running an affected version. The CVSS 3.1 score of 7.5 (network vector, no privileges required) indicates the attacker gains high confidentiality impact, with no integrity or availability impact. Any WordPress/WooCommerce site running the plugin at version 1.2.2 or older is affected. No public proof-of-concept, no known in-the-wild exploitation, and the vulnerability is not listed in CISA KEV.

Do: Update the plugin to the latest release (any version above 1.2.2) via the WordPress admin or the WordPress.org plugin directory. If an immediate update is not possible, deactivate the plugin until a patched version is available, since there is no public PoC or signature to detect attacks. Review access logs for unexpected unauthenticated requests to the site's AJAX/admin-post endpoints referencing this plugin.

CVE-2026-81431 is an improper privilege management flaw (CWE-269) in the Registration Form for WooCommerce WordPress plugin before version 1.1.3, which does not validate that the form referenced during registration is a legitimate registration form and instead reads the permitted-role allow-list from an arbitrary, attacker-controlled post. Any authenticated user with post-creation rights — Contributor role and above — can reference a crafted post during registration, bypassing the intended role restrictions and creating a new account with an arbitrary role, including Administrator. An attacker thereby gains full administrative control of the affected site (complete site takeover), with high impact on confidentiality, integrity, and availability. Sites running the plugin before 1.1.3 are affected, and because this is an incomplete fix of the earlier CVE-2026-54807, sites that applied that earlier patch may still be exposed. No public proof-of-concept or CISA KEV listing is known, and there is no confirmed exploitation in the wild as of this analysis.

Do: Upgrade the plugin to version 1.1.3 or later; because this is an incomplete fix of CVE-2026-54807, being on the earlier patched version is not sufficient. Until patched, restrict registration and post-creation privileges to trusted users and audit the users list for accounts created with elevated roles (especially Administrator) that could indicate prior exploitation. Also review registration activity for requests referencing non-registration posts, which is the telltale of this bypass.

CVE-2026-78361 is a critical missing-authorization flaw (CWE-862) in the zipMoney (Zip Co) Payments Plugin for WooCommerce, a WordPress payment gateway plugin. The plugin's front-end request handler performs no authorization checks and does not restrict which option name a caller may supply, so any unauthenticated visitor can send a crafted request that deletes an arbitrary WordPress option. By targeting key options such as the site URL or the list of active plugins, an attacker can destroy site and access-control configuration, deactivate every installed plugin, and take the site offline; the impact is limited to integrity and availability, with no confidentiality loss. Only WordPress sites running the plugin in a version prior to 2.4.0 are affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA's KEV.

Do: Update the plugin to version 2.4.0 or later. As an interim measure, block unauthenticated requests reaching the plugin's front-end handler (for example with WAF rules on the relevant action and option-name parameters) and confirm that critical options such as the site URL, home URL, and active-plugins list have not been deleted. Operators who notice unexpected site downtime or mass plugin deactivation should check for evidence of this option-deletion request pattern.

The Ultimate Gift Cards for WooCommerce WordPress plugin before version 3.2.10 lacks an authorization check when displaying gift card details, allowing any unauthenticated visitor to retrieve the gift cards attached to arbitrary orders. An attacker who can trigger this display for orders on a vulnerable store obtains customer personal data, gift card balances and dates; on version 3.2.9 the live redemption code is also exposed, which anyone holding it can redeem. Versions 3.0.3 through 3.2.8 disclose the same data but without the redemption code. Any WooCommerce store running the plugin in the affected range is exposed, with risk concentrated on stores that actively sell gift cards. There is no known public proof-of-concept and the flaw is not in CISA's KEV, so confirmed in-the-wild exploitation has not been reported.

Do: Upgrade Ultimate Gift Cards for WooCommerce to version 3.2.10 or later. Stores that ran version 3.2.9 should review gift card orders for unauthorized redemptions and consider reissuing any redemption codes that may have been exposed. As an interim mitigation, restrict unauthenticated requests to the plugin's gift card display functionality (e.g., via WAF rules) until the update is applied.

CVE-2026-19436 is a business-logic flaw (CWE-284) in the Ultimate Gift Cards for WooCommerce WordPress plugin, which issues gift card coupons to shoppers during checkout. The plugin fails to reconcile the value of the coupon it creates against the amount actually collected at checkout, so an unauthenticated shopper can complete a gift card purchase and receive store credit worth more than the payment they made, with no special conditions, privileges, or user interaction required. An attacker gains excess store credit or coupons on the affected store, which is a direct financial loss (revenue leakage) for the merchant rather than a code-execution or data-exposure issue, consistent with the integrity-only CVSS impact. Any WooCommerce store running the plugin before version 3.2.10 is affected. There is no public proof of concept, the flaw is not in CISA's KEV, and no exploitation is currently known.

Do: Update the plugin to version 3.2.10 or later, then review recently issued gift card coupons for value-versus-payment mismatches and signs of abuse. Until patched, disabling the gift card purchase/checkout flow is a practical stopgap. Even with no known public PoC, monitor order logs for unauthenticated gift card orders where the issued coupon value is disproportionate to the amount collected.

CVE-2026-15019 is an unauthenticated directory traversal vulnerability (CWE-22) in the Direct Download for WooCommerce WordPress plugin, affecting all versions up to and including 1.19, in the plugin's file-serving (include) logic. A remote, unauthenticated attacker can send a crafted request to the plugin's download endpoint with a path value that escapes the intended download directory; the plugin's ownership check only verifies that some free, virtual, downloadable product exists on the site, not that the requested path belongs to that product's configured downloads. This allows the attacker to read the contents of arbitrary files on the server, such as wp-config.php containing database credentials and authentication keys, with no modification of files or system state. Any WordPress/WooCommerce site running the plugin at version 1.19 or earlier and having at least one free, virtual, downloadable product is exploitable. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known as of this writing; severity is rated high (CVSS 3.1 7.5, confidentiality impact only).

Do: Update Direct Download for WooCommerce to the first release after 1.19 as soon as one is published (the source data confirms 1.19 is affected but does not name the patched version). Until an update is available, deactivate the plugin or apply a WAF/virtual-patch rule blocking directory-traversal sequences in its download request parameters. Site owners should check whether their catalog contains any free, virtual, downloadable product (which makes the site exploitable) and review access logs for unexpected requests to the plugin's download endpoint.

The Address Delete controller in Mageplaza's GDPR extension for Magento 2 (mageplaza/module-gdpr) through version 4.2.9 lacks an authorization check: it extends Magento's legacy Action class rather than AbstractAccount, so requests are not required to be authenticated, to belong to the address owner, or to carry a valid form key. An unauthenticated remote attacker can delete any customer's saved address by sending a GET request to /customer/address/delete/id/{id} with an arbitrary address ID. By iterating address IDs, the attacker can erase every stored customer address on the affected store; the impact is to data integrity only (CVSS C:N/I:H/A:N), with no data exposure or code execution. Any Magento 2 store running the affected Mageplaza GDPR module is exposed, with impact concentrated in loss of saved customer address records rather than site takeover. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is currently known.

Do: Check the installed mageplaza/module-gdpr version and upgrade to a release newer than 4.2.9 as soon as Mageplaza publishes a patched version. As an interim mitigation, block or require authentication for GET requests to /customer/address/delete/id/ at the web server or WAF level, and review access logs for unauthenticated hits to that endpoint to detect any address deletion already performed.

CVE-2026-79323 is an information disclosure flaw (CWE-200) in the blogComments GraphQL query of the Magefan Blog GraphQL extension (magefan/module-blog-graph-ql) for Magento 2. A remote, unauthenticated attacker can send a POST request to the store's /graphql endpoint invoking the blogComments query, which returns more data than it should. The attacker gains blog commenters' email addresses along with internal customer and admin account identifiers, with no privileges or user interaction required (CVSS 3.1: 7.5, high confidentiality impact). Any Magento 2 store running this module in version 2.2.1 or earlier is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known as of publication.

Do: Update magefan/module-blog-graph-ql to the first patched release after 2.2.1 (check Magefan's changelog) and deploy it with a standard composer update and cache flush. As an interim mitigation, restrict or disable unauthenticated access to the blogComments GraphQL query (e.g., via GraphQL introspection/field controls or edge rules) so commenter email addresses are not returned. Review web logs for unauthenticated POSTs to /graphql invoking blogComments and consider notifying commenters whose email addresses may have been exposed.

CVE-2026-79322 is an unauthenticated SQL injection (CWE-89) in the RelatedProduct block of Mageplaza Blog for Magento 2, affecting all versions through 4.3.2. A remote attacker can trigger it by sending a crafted id parameter to the /mpblog/post/view route, with no authentication or user interaction required. Successful exploitation permits execution of arbitrary SQL commands and reading of arbitrary database contents, which typically includes sensitive Magento data such as customer records, orders, and admin credentials, with limited additional integrity and availability impact per the CVSS vector. Any Magento 2 store running the Mageplaza Blog extension at version 4.3.2 or older, with blog routes reachable by unauthenticated visitors, is affected. The flaw is not currently in CISA's KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.

Do: Upgrade the Mageplaza Blog extension to the latest release, i.e., any version newer than 4.3.2, or apply the vendor patch when available. Until patched, mitigate by blocking or strictly validating the id parameter on /mpblog/post/view at the web application firewall, or by disabling the extension's blog routes. Review web and database logs for anomalous SQL activity tied to the blog route to check for prior exploitation.

Versions up to and including 3.35.0 of the YITH WooCommerce Waitlist Premium plugin for WordPress expose an AJAX handler (registered on the wp_ajax_yith_wcwtl_add_user action) that lacks both a capability check and nonce verification and imports attacker-controlled variables from $_POST['params'] using parse_str() and extract(). Because those variables are passed directly to wp_create_user() and $user->set_role(), any authenticated user with Subscriber-level access or higher can send a crafted request that creates a new user account with the administrator role. Successful exploitation gives the attacker full administrator-level control of the affected site, enabling plugin and content changes and further compromise. Only sites running the Premium edition of YITH WooCommerce Waitlist at version 3.35.0 or earlier are affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported at this time.

Do: Update YITH WooCommerce Waitlist Premium to the latest available release newer than 3.35.0, which restores the missing capability check and nonce verification on the yith_wcwtl_add_user AJAX action. Until patched, consider temporarily deactivating the plugin if your site does not depend on waitlists, and review subscriber accounts. After patching, audit the WordPress Users list and logs for newly created administrator accounts or unexpected role changes that could indicate attempted or successful exploitation.

The Next-Cart Store to WooCommerce Migration plugin for WordPress, in all versions up to and including 3.9.8, allows unauthenticated attackers to bypass authentication on its /wp-json/next_cart/v1/migration REST endpoint because the route has no permission requirement and the handler's token check falls back to the hardcoded value __token__ when the nextcart_token option has never been written to the database. This fallback condition occurs when the plugin is activated via WP-CLI, multisite network activation, or programmatically without a subsequent authenticated visit to wp-admin, since real token generation is deferred to admin_init; sites activated through wp-admin generate a real token and are not exposed. An unauthenticated attacker who supplies the literal string __token__ as the token reaches privileged handlers that pass attacker-controlled SQL directly to $wpdb->query() and $wpdb->get_results() and pass attacker-controlled paths to unlink(). Through these handlers an attacker can execute arbitrary SQL, including creating a new administrator account, and delete arbitrary files, enabling full site takeover. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not on the CISA KEV catalog.

Do: Sites running the plugin should update to a patched release newer than 3.9.8 as soon as the vendor ships one; until then, populate the nextcart_token option by visiting wp-admin once while authenticated after activation, or temporarily deactivate the plugin, since the hardcoded __token__ fallback is the core risk. Because exploitation enables arbitrary SQL execution and file deletion, also check affected sites for unexpected administrator accounts and missing or modified files.

CVE-2026-14962 is an unauthenticated SQL injection flaw (CWE-89) in the ELEX WooCommerce Request a Quote WordPress plugin, caused by insufficient sanitisation and escaping of a parameter before it is used in a SQL query. Because the vulnerable code path requires no authentication, any unauthenticated visitor to a site running the plugin can inject SQL through the affected parameter. Successful exploitation allows the attacker to extract arbitrary data from the WordPress database, which may include sensitive tables such as user accounts and order data; the CVSS scoring (8.6, confidentiality-high) indicates impact is limited to data disclosure, with no integrity or availability loss. Only WooCommerce stores running versions of the plugin before 2.4.1 are affected. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Sites running the ELEX WooCommerce Request a Quote plugin should upgrade to version 2.4.1 or later. If an immediate upgrade is not possible, consider virtual patching via a WAF (e.g., blocking SQL metacharacters in the vulnerable parameter) and monitor web/database logs for anomalous queries. Because exploitation may be silent, also review whether sensitive database content such as user credentials may have been accessed.

The FireBox WordPress plugin (popup builder, exit-intent popups, email opt-in, and cart abandonment) is vulnerable to remote code execution through the value function in all versions up to and including 3.1.10. The Executer::allowedToRun() regex blacklist that gates which PHP functions may run is trivially bypassable — it fails to block core functions such as wp_insert_user, update_option, and file_put_contents — and PHP condition rule values saved through the firebox_meta REST endpoint are not sanitized. An authenticated attacker with author-level privileges or higher can therefore store and trigger crafted condition values that execute arbitrary code on the web server. On sites that were upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically granted the edit_fireboxes and publish_fireboxes capabilities to the Author role, widening the pool of accounts able to exploit the flaw. No public proof-of-concept is known and the vulnerability is not listed in CISA KEV, so exploitation status is currently none known.

Do: Update FireBox to a release newer than 3.1.10 as soon as a patched version is available. On sites upgraded from pre-3.1.10 versions, review the Author role (e.g., with a capabilities manager) and consider removing the automatically granted edit_fireboxes and publish_fireboxes capabilities until all author-level users are trusted, and audit the firebox_meta REST endpoint data for suspicious PHP condition values.

Adobe Commerce, Adobe Commerce B2B, and Magento Open Source are affected by a stored cross-site scripting flaw (CWE-79) in which an attacker submits crafted content into a vulnerable form field and the malicious JavaScript later executes in any user's browser when they view the page containing that field. The attack vector requires no authentication (network vector, low complexity), but does require user interaction, and the changed scope means injected script can act beyond the vulnerable page, potentially giving the attacker elevated access or control over the victim's account or session. Any organization running an affected version of Adobe Commerce, Adobe Commerce B2B, or Magento Open Source is exposed, especially storefronts that allow unauthenticated form submissions and admin panels reached by privileged users. Exploitation status: no public proof-of-concept is known, the flaw is not listed in CISA KEV, and EPSS estimates only a 0.8% probability of exploitation within 30 days, so no confirmed in-the-wild exploitation is documented yet.

Do: Apply the patched release referenced in Adobe's security bulletin for CVE-2026-76201 across all Adobe Commerce, Adobe Commerce B2B, and Magento Open Source deployments (exact patched versions are listed in the bulletin). Until patching, review content stored in storefront and admin form fields for unexpected scripts, and restrict/review admin access since stored XSS payloads may already be persisted. If compromise is suspected, rotate credentials for privileged accounts, as changed scope means admin sessions can be hijacked.

CVE-2026-76200 is a stored Cross-Site Scripting (CWE-79) flaw in Adobe Commerce that lets an attacker persist malicious JavaScript in vulnerable form fields. When a victim later browses to a page containing the injected field, the script executes in their browser with the CVSS scope-change (S:C) indicating the impact crosses component boundaries, such as reaching an admin or another user's session. An attacker who succeeds can gain elevated access or control over the victim's account or session, which on an e-commerce platform could mean admin panel access or compromise of customer accounts. Affected products are Adobe Commerce, Magento, and the Commerce B2B offering, with specific affected and fixed version ranges not stated in the available data. Exploitation has not been confirmed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.8% chance of exploitation within 30 days.

Do: Patch by upgrading to the release specified in Adobe's security bulletin for this CVE, prioritizing stores with internet-exposed account or checkout forms where the vulnerable fields can be populated. Until patched, restrict and sanitize input to the affected form fields and review recent admin/customer session activity for signs of hijacking. Because scope is 'changed', assume a successful injection could compromise higher-privileged sessions than the field's own context, so validate any admin accounts that interacted with attacker-modified content.

CVE-2026-81790 is a missing-authorization flaw (CWE-862) in the WordPress/WooCommerce plugin "Csomagpontok és szállítási címkék WooCommerce-hez" (pickup points and shipping labels) by Viszt Péter, where incorrectly configured access controls allow requests to bypass required permission checks. Because the check is absent for unauthenticated users (CVSS AV:N/PR:N), a remote attacker with no account can invoke the affected plugin functionality over the network. Per the CVSS 3.1 vector, the attacker gains high integrity impact (ability to modify data or settings) with no confidentiality or availability impact. All plugin versions before 4.2.8 are affected, so any WooCommerce shop running an older version is exposed. There is currently no known public PoC, no CISA KEV listing, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days (18th percentile), so exploitation is not known to be occurring.

Do: Update the plugin to version 4.2.8 or later as soon as possible. If immediate patching is not possible, restrict unauthenticated access to the plugin's endpoints (e.g., via WAF rules) and review pickup-point/shipping-label settings and related data for unauthorized changes. No public PoC or in-the-wild exploitation is known, but remediation is straightforward and should be prioritized given the flaw is remotely exploitable without credentials.

WooCommerce, the e-commerce plugin for WordPress from Automattic, contains an 'Allocation of Resources Without Limits or Throttling' flaw (CWE-770) that allows HTTP denial of service. An unauthenticated remote attacker can trigger it over the network with low complexity by sending requests that cause the plugin to allocate resources without any cap or rate limiting, exhausting server capacity. The impact is availability-only: an attacker can degrade or take down the affected storefront but gains no confidentiality or integrity impact. Any WooCommerce deployment running a version before 11.1.0 is affected. Exploitation has not been observed: there is no known public proof-of-concept, the CVE is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

Do: Upgrade WooCommerce to version 11.1.0 or later, which resolves this issue. Until patched, check your installed WooCommerce version in the WordPress plugins list and consider WAF or reverse-proxy rate limiting on the store's public endpoints to blunt unauthenticated request floods. There is no evidence of active exploitation, so patching at normal priority is reasonable, though high-availability storefronts should patch sooner.

Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08.

Do: Apply Adobe's released patches immediately per vendor instructions, prioritizing internet-facing Commerce/Magento storefronts, and ensure compliance with CISA BOD 26-04 timelines for KEV entries. Hunt for 'StyleSmuggler' indicators of compromise, including unexpected Rust backdoor binaries and PHP web shells on hosts, and review template/theme customizations for tampering. Exact fixed version numbers are not included in the available data, so consult Adobe's advisory for the correct patched release for your Commerce/Magento version line.

The Mail Mint WordPress plugin (email marketing, newsletter, and automation) deserializes untrusted input in its 'handle_form_submission' function without adequate validation, enabling unauthenticated attackers to inject a PHP object. Because the form-submission handler requires no authentication or privileges, any visitor able to reach a Mail Mint form can trigger the flaw. By supplying a crafted serialized object, an attacker can exploit an available POP chain to execute code on the server, potentially leading to full site compromise (CVSS 9.8). All versions through 1.31.0 are affected; the fix in 1.23.1 was only partial, so sites running even partially patched releases remain exposed. No public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS assigns a 0.6% probability of exploitation within 30 days, indicating no confirmed in-the-wild exploitation yet.

Do: Update Mail Mint to the first available release after 1.31.0, since 1.23.1 was only a partial fix and should not be relied upon. Until a fully patched release is applied, deactivate the plugin or restrict access to its form submission endpoints, and consider WAF rules blocking serialized-object (O:) patterns in form POSTs. No public PoC is known, but the flaw is unauthenticated and trivially triggerable wherever forms are exposed, so treat patching as high priority.

CVE-2026-81543 is a privilege-escalation flaw in the Abandoned Cart Pro for WooCommerce WordPress plugin: several of its AJAX actions (wcap_save_connector_settings, wcap_send_manual_email, wcap_abandoned_cart_info, and wcap_change_manual_email_data) lack capability checks and nonce verification. Any logged-in user with subscriber-level access or above can therefore invoke these actions, for example rewriting the plugin's SMTP connector settings so that the store's administrator recovery emails are routed through an attacker-controlled mail server. With the plugin's auto-login feature enabled (its default configuration), the attacker can then trigger a recovery email, capture the auto-login link it contains, and use it to obtain full administrator access to the site. Any WordPress site running the plugin in versions up to and including 10.7.1 is affected, provided it has at least one subscriber-level account, which is effectively every WooCommerce store with customer registration. No public proof-of-concept or confirmed in-the-wild exploitation is known, and EPSS currently assigns roughly a 0.2% probability of exploitation within 30 days.

Do: Update Abandoned Cart Pro for WooCommerce to a release newer than 10.7.1 on every store where the plugin is active. Until patched, disable the plugin's auto-login feature, restrict or vet subscriber registrations, and verify that the SMTP connector settings have not been altered. Also review recent administrator password-reset/recovery emails and admin logins for signs that auto-login links were intercepted.

CVE-2026-57777 is a blind SQL injection flaw in WooCommerce, Automattic's e-commerce plugin for WordPress, caused by improper neutralization of special elements used in an SQL command (CWE-89). The vulnerability is network-reachable but requires the attacker to already hold a high-privilege account (CVSS privileges required: high), meaning privileged user input is passed into a SQL query without adequate sanitization. Successful exploitation enables blind extraction of database contents, with CVSS rating the confidentiality impact as high (and availability impact low), potentially exposing store, customer, and order data. Any WordPress site running WooCommerce in any version before 11.0 is affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days, so no in-the-wild exploitation is known.

Do: Update WooCommerce to 11.0 or later as soon as possible. Because exploitation requires a high-privilege account, audit administrator and shop-manager accounts, remove unnecessary privileged users, and review their recent activity for signs of data exfiltration; WAF rules that block common blind SQL injection patterns can serve as a temporary mitigation.

YITH Request a Quote for WooCommerce Premium, in versions before 4.46.0, contains an unauthenticated broken access control flaw classified as CWE-862 (Missing Authorization), meaning functionality that should verify a user's permissions performs no authorization check at all. Because no credentials are required, any remote attacker can trigger the affected functionality directly over the network with no user interaction, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). The critical 9.8 rating, with high impact to confidentiality, integrity, and availability, indicates an attacker can access protected functionality and data as if authorized, exposing or manipulating sensitive quote and store information. All deployments of the Premium edition prior to 4.46.0 are affected; the free edition is not named in the advisory. There is currently no public proof of concept, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS puts 30-day exploitation probability at just 0.3% (19th percentile), so no in-the-wild exploitation is documented.

Do: Upgrade YITH Request a Quote for WooCommerce Premium to version 4.46.0 or later, and confirm the installed version on the WordPress plugins screen. Since the flaw is exploitable without credentials and no public PoC exists, a WAF rule restricting unauthenticated access to the plugin's endpoints is a reasonable interim measure while patching. No other mitigations are documented in the available advisory data.

CVE-2026-81774 is an unauthenticated sensitive data exposure flaw (CWE-497, exposure of sensitive information to an unauthorized control sphere) in the WooCommerce Product Attachment plugin for WordPress, affecting all versions up to and including 2.3.3 and scored 7.5 (High) with a fully network-based, low-complexity attack vector. An unauthenticated remote attacker can trigger it by sending ordinary HTTP requests to the plugin's exposed functionality, with no login, privileges, or user interaction required. The attacker gains read access to sensitive data handled or exposed by the plugin or host site (high confidentiality impact only; no integrity or availability impact per the CVSS score). Affected parties are WordPress e-commerce sites running WooCommerce with WooCommerce Product Attachment installed at version 2.3.3 or earlier. As of this advisory the flaw is not known to be exploited: EPSS is 0.3% (23rd percentile), it is not in CISA's KEV, and no public proof-of-concept exists.

Do: Update WooCommerce Product Attachment to the latest vendor release (any version newer than 2.3.3) as soon as one is available. Until patched, restrict access to plugin-managed attachment files and endpoints, review web logs for unauthenticated requests to them, and assume any sensitive documents served through the plugin may have been quietly read.

CVE-2026-81288 is an unauthenticated cross-site scripting (XSS, CWE-79) flaw in the Upsell Order Bump Offer for WooCommerce WordPress plugin, affecting all versions up to and including 3.1.5. Because no authentication is required, an unauthenticated attacker can inject malicious script that executes when a victim — per the CVSS user-interaction requirement, most plausibly a store admin or shopper — views a crafted link, request, or page; the CVSS scope-change flag indicates the injected script can act beyond the vulnerable component's normal trust boundary. A successful attack lets the attacker run arbitrary JavaScript in the victim's browser on the WooCommerce store, enabling actions such as stealing session cookies or performing unintended actions in the victim's context. Any WordPress/WooCommerce site running the plugin at version 3.1.5 or older is affected. There is currently no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within 30 days.

Do: Update the plugin to the latest release (any version after 3.1.5; confirm the exact fixed version in the vendor changelog). Until patched, administrators should review recently changed or added admin accounts and check checkout/upsell pages for unexpected scripts or injected content, since an unauthenticated XSS can target admin browsers. Monitor the plugin page for the patched release and consider web-application-filter rules on plugin endpoints.

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 fails to sanitise and escape the content of customer reviews submitted through one of its endpoints. An unauthenticated attacker can submit a review containing malicious HTML/JavaScript, which is then stored and executed in the browser of anyone who views the review content, such as an administrator moderating reviews or a customer browsing the shop. By running attacker-controlled JavaScript in an admin's or visitor's browser, the attacker can perform actions in that user's session, such as creating backdoor admin users, altering pages, or redirecting visitors. Any WooCommerce store running the plugin in a version below 5.118.0 is affected. There is currently no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days, so no in-the-wild exploitation is known.

Do: Update the plugin to version 5.118.0 or later. Until patched, restrict or disable unauthenticated review submission through the affected endpoint and moderate incoming reviews manually; after patching, review stored customer reviews for injected HTML/script tags and watch for unexpected admin users or modified site content that could indicate exploitation.

Custom User Registration Fields for WooCommerce, a WordPress plugin used with WooCommerce stores, contains a critical unauthenticated privilege escalation flaw in versions up to and including 2.2.3. The plugin accepts an attacker-controlled 'afreg_select_user_role' value from the unauthenticated WooCommerce Store API checkout request (/wc/store/v1/checkout), persists it in order meta, and later passes it directly to WP_User::add_role() during order processing on the woocommerce_thankyou hook without validating it against the admin-configured allowed role list. An unauthenticated attacker who creates an account during checkout can modify the JSON body to request the administrator role (or any other role slug) and gain full administrative control of the site. Only sites running version 2.2.3 or earlier with the plugin's 'User Role Selection' setting enabled are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS estimates only a 0.4% probability of exploitation within 30 days.

Do: Update the plugin to a version newer than 2.2.3 as soon as a patched release is published (no fixed version number was provided in the source data), and verify the installed version on the WordPress Plugins page. As an interim mitigation, disable the plugin's 'User Role Selection' setting so checkout role data is not applied to newly created accounts. Also audit recently created user accounts for unexpected Administrator role grants, since successful exploitation adds the attacker-specified role.

CVE-2026-16947 is an unauthenticated server-side request forgery (CWE-918) combined with missing response-authenticity verification in the Total Processing Card Payments for WooCommerce WordPress plugin, affecting all versions through 7.3. The plugin builds a server-side payment verification request from a user-supplied path without validating it, and does not verify that the response it receives genuinely comes from the payment gateway. An unauthenticated attacker can redirect that request to an arbitrary attacker-controlled host, causing the merchant's payment-gateway credentials to be disclosed, and can return a forged success response that marks arbitrary WooCommerce orders as paid without actual payment. Any WordPress/WooCommerce store running the affected versions is exposed, with no authentication or user interaction required. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates only a 0.2% probability of exploitation within 30 days.

Do: Upgrade the plugin to a release newer than 7.3 as soon as the vendor publishes a fix (no fixed version number is available in the source data). Until patched, audit recent WooCommerce orders for transactions marked paid without a matching gateway payment, and treat stored Total Processing API credentials as potentially exposed, rotating them if compromise is suspected; a WAF rule restricting unauthenticated requests to the plugin's verification endpoint may reduce exposure.

CVE-2026-6176 is a stored cross-site scripting (CWE-79) vulnerability in the Customer Reviews for WooCommerce WordPress plugin, present in all versions up to and including 5.106.0, caused by insufficient input sanitization and output escaping of user-supplied review comment text. An unauthenticated attacker who has a valid review form URL - normally a customer who received one of the plugin's review reminder emails after placing an order - can submit a crafted review through the 'cr_local_forms_submit' AJAX action, and the plugin stores the unsanitized HTML in a comment via wp_insert_comment(). When that review is later rendered on a product page through comment_text(), the injected script executes in the browser of anyone who views the page, letting the attacker run arbitrary JavaScript to steal session data, redirect shoppers, or alter page content. Any WooCommerce store running the plugin at version 5.106.0 or earlier is affected - especially stores that send aggregated review invitation emails - and the flaw is rated High severity (CVSS 3.1: 7.2) with confidentiality and integrity impact but no availability impact. No public proof-of-concept, no CISA KEV listing, and a low EPSS score (0.3% chance of exploitation within 30 days) indicate that exploitation has not yet been observed.

Do: Update Customer Reviews for WooCommerce to a release later than 5.106.0 (the patched version published by the developer) on all WooCommerce stores, prioritizing shops that use review reminder emails. As an interim mitigation, disable or restrict the aggregated review form and its reminder-email links, and audit existing review comments for embedded HTML or script tags. Because no public proof-of-concept or in-the-wild exploitation is known, this can be handled on a normal patch cycle while monitoring for the fixed release.

Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.

Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.

Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthenticated attackers to send a crafted email to the site's configured inbound mailbox with a forged References header matching the plugin's expected pattern and an attachment filename such as `../helper.php`, causing the cron-based IMAP sync job to write attacker-controlled PHP outside of the .htaccess-protected `crm-attachments` directory and into `wp-content/uploads/`. On configurations where PHP executes in uploads, this can lead to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured.

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the site being taken over.

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9.4. This is due to the `rum_importer()` function being registered on the WordPress core `import_start` action hook with no plugin-owned capability check and no allowlist filtering, causing arbitrary ` ` name/value pairs parsed from an attacker-supplied WXR import file to be passed directly to `update_option()`. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to write arbitrary WordPress options — most critically setting `users_can_register` to `1` and `default_role` to `administrator` — enabling open self-registration of Administrator accounts and full site takeover. This is exploitable by Shop Manager-level users because WooCommerce grants that role the `import` capability, allowing it to reach the WordPress Importer flow that fires the `import_start` hook on which `rum_importer()` is registered, contrary to the assumption that the hook is restricted to Administrators.

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress <= 8.9.1 versions.

Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions.