Vulnerabilities

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 4.1.23. Its PermissionManager::manage_permissions() function, hooked to WordPress core's map_meta_cap filter, unconditionally returns the always-true 'exist' primitive for every capability check whenever the evaluated user ID is 1, without scoping this to plugin-specific capabilities. An authenticated attacker who controls the site's user ID 1 account — even one demoted to Subscriber, a common administrator-account hardening practice — can therefore pass every capability check, including manage_options, edit_plugins, edit_themes, promote_users, and update_core, gaining administrator-equivalent power, full site takeover, and remote code execution via the plugin and theme editors. On default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs, which explains the High attack-complexity CVSS 3.1 score of 7.5. No public proof of concept is known and the flaw is not listed in CISA's KEV catalog, so exploitation is currently considered none known.

Do: Update Eventin to a version newer than 4.1.23 (the latest release) as soon as possible. If you use the 'demote user ID 1' hardening pattern, audit that account for signs of compromise and enforce a strong password plus two-factor authentication until patched. As a defense-in-depth measure against the plugin/theme editor RCE path, define DISALLOW_FILE_EDIT in wp-config.php.

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine_product_title_header_size’ parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Alior Bank's 'raty' installment-payment module for PrestaShop contains a SQL injection flaw (CVSS 4.0: 8.6) in the hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter hook methods, which run when a product or category is saved in the backoffice. The module inserts the POST parameters alior_product_promotion, alior_category_promotion, and alior_category_enabled directly into SQL UPDATE queries with no sanitization or validation. An attacker with access to the product or category add/edit functionality — for example a low-privilege employee account with catalog permissions — can inject arbitrary SQL and read or modify database contents, including customer, order, and administrative data. Affected deployments are PrestaShop shops running the module in versions prior to 8.1.11 or 9.0.7, most plausibly merchants in Poland offering Alior Bank installment payments. No public proof of concept or in-the-wild exploitation is known, and the issue is not listed in the CISA KEV catalog.

Do: Update the raty module to 9.0.7 or 8.1.11, matching the version line you run, and disable or remove the module until the patch is applied. Restrict backoffice rights to add or edit products and categories to trusted staff, since that level of access is required to trigger the injection. Review database audit logs, admin accounts, and catalog records for signs of unexpected UPDATE queries or unauthorized data changes.

The Alior Bank 'raty' installment module for PrestaShop (distributed to the bank's commercial partners) contains a SQL injection flaw in its toggleCategoryPromotionAction method, where the raw value of the POST parameter 'status' is inserted into SQL UPDATE queries without any sanitization or validation. An attacker who already has access to product or category add/edit functionality in the PrestaShop backoffice can submit a crafted 'status' value to inject and execute arbitrary SQL. Successful exploitation allows unauthorized reading and modification of the shop's database contents, including sensitive customer and order data, which is reflected in a CVSS 4.0 score of 8.6 (high). Affected sites are PrestaShop stores running this module, which is only offered to Alior Bank commercial partners — predominantly Polish merchants offering Alior installment payments. No public proof of concept exists and no exploitation in the wild has been reported; the CVE is not listed in CISA's KEV catalog.

Do: Contact Alior Bank for a patched version of the 'raty' module and apply it as soon as one is released; if the installment feature is not needed, disable or remove the module in the meantime. Restrict PrestaShop backoffice permissions so that only fully trusted employees can add or edit products and categories, since the flaw requires that level of access. Review database and application logs for anomalous UPDATE queries or unexpected data changes originating from the module's promotion-toggle action.

The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel or fail them.

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site.

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belonging to other customers.

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin for WordPress is affected by an unrestricted file-upload flaw (CWE-434): the mipl_wc_upload_file function performs no file-type validation in all versions up to and including 1.2.1. An unauthenticated, remote attacker can trigger the flaw by submitting a crafted upload request over the network, with no authentication or user interaction required (CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N). By uploading arbitrary files — for example a PHP script — to a web-executable location, the attacker may achieve remote code execution and compromise the site, matching the high confidentiality, integrity, and availability impact reflected in the critical 9.8 score. Any WordPress site, typically a WooCommerce store, running the plugin at version 1.2.1 or older is affected. As of the available data there is no public proof-of-concept, the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

Do: Update the plugin to the first available release newer than 1.2.1 once a patched version is published (no fixed version number is stated in the available data), or deactivate the plugin until a fix ships. As an interim mitigation, deny PHP execution in the upload destination used by the plugin (typically under wp-content/uploads) via web-server rules so uploaded files cannot run. Because the flaw is exploitable by unauthenticated users on internet-facing stores, check the uploads directory for unexpected PHP or other unfamiliar files and review web-server logs for unauthenticated POST requests to the plugin's upload endpoint.

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to, and including, 2.7.2. The vulnerability exists because the OTP rate-limit attempt counter in `process_otp_form` is keyed exclusively on the attacker-controlled `xoo_ml_user_ip_data` cookie's `ip_address` field, allowing unlimited counter resets by simply rotating the cookie, while the OTP itself is generated with PHP's non-cryptographic `rand()` function over a default space of only 9,000 possible values (1000–9999), and both the OTP issuance endpoint (`xoo_ml_login_with_otp`) and verification endpoint (`xoo_ml_otp_form_submit`) are registered as unauthenticated `wp_ajax_nopriv` actions with no nonce or capability checks. This makes it possible for unauthenticated attackers to brute-force the OTP for any registered account and obtain a full WordPress authentication session — including for administrator accounts — via `wp_set_auth_cookie()` in `login_user_with_otp()`. Exploitation requires the attacker to know the target user's registered phone number, which is used to trigger OTP issuance via the unauthenticated `xoo_ml_login_with_otp` endpoint.

The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs.

CVE-2026-81799 is a broken access control vulnerability (missing authorization, CWE-862) in the Return Refund and Exchange For WooCommerce WordPress plugin, affecting all versions up to and including 4.6.4. A privileged action in the plugin lacks a proper authorization check, so any unauthenticated visitor can trigger it over the network with no privileges or user interaction required. An attacker who does this can modify data managed by the plugin — plausibly return, refund, and exchange (RMA) request information — and the CVSS score (C:N/I:H/A:N) indicates integrity-only impact with no confidentiality loss or service disruption. Any WordPress/WooCommerce store running the plugin at version 4.6.4 or older is affected; sites without the plugin are not. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and no in-the-wild exploitation is known.

Do: Update Return Refund and Exchange For WooCommerce to the latest patched release (any version newer than 4.6.4). Until patched, deactivate the plugin or restrict unauthenticated access to its AJAX/REST endpoints, and review logs and existing return/refund/exchange records for signs of tampering. Since there is no public PoC or known exploitation yet, patching at the next maintenance cycle is reasonable unless the store is heavily exposed.

CVE-2026-81794 is a broken access control flaw (CWE-862, missing authorization) in the Shirt Product Designer for WooCommerce WordPress plugin, in which a privileged action is reachable without any authentication check. An unauthenticated attacker triggers it by sending a crafted network request directly to the affected endpoint, since the code performs the action without verifying user privileges or intent. Per the CVSS vector (Network, Low complexity, No privileges, No user interaction, Integrity impact High), a successful attack lets the attacker modify data on the site, such as plugin or store data, without reading or disrupting it. Any WordPress/WooCommerce site running the disclosed affected version (1.0.4) of the plugin is in scope; the available data does not specify the exact fixed release. There is no public proof of concept, the CVE is not in CISA's KEV, and no exploitation has been observed to date.

Do: Update Shirt Product Designer for WooCommerce to the latest patched release as soon as one is published, and check the vendor/WordPress.org changelog for the fixed version number. Until patched, consider disabling the plugin if it is not essential, or blocking unauthenticated requests to the plugin's endpoints via a WAF or web server rules. Review the site for unexplained modifications to product, order, or plugin settings, since the flaw's primary impact is unauthorized data changes.

CVE-2026-81789 is an unauthenticated arbitrary file deletion vulnerability (path traversal, CWE-22) in the Advanced Product Fields Extended for WooCommerce WordPress plugin, affecting all versions up to and including 3.1.6. Because the vulnerable code is reachable through network-facing WooCommerce/plugin endpoints without requiring a login, a remote attacker can submit traversal paths that cause the plugin to delete an arbitrary file on the server. The immediate impact is to site availability, which the CVSS 8.6 score reflects (high availability impact, changed scope), and in WordPress, removal of critical files such as wp-config.php can additionally open the door to full site compromise, though no published exploit chain describes that escalation. Any WordPress site running the plugin at version 3.1.6 or earlier as part of a WooCommerce store is affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is currently known.

Do: Update Advanced Product Fields Extended for WooCommerce to the newest release (any version above 3.1.6) as soon as practical. As an interim mitigation, block or rate-limit unauthenticated requests to the plugin's endpoints at the WAF and verify the integrity of core files such as wp-config.php if you suspect tampering. Because no public PoC exists yet, patching now closes the window before exploit details typically emerge.

CVE-2026-81786 is a missing-authorization flaw (CWE-862) in the Thank You Page Customizer for WooCommerce WordPress plugin, allowing an unauthenticated attacker to invoke a restricted function without any login or user interaction. It is triggered by sending a crafted, unauthenticated HTTP request to the vulnerable routine on any site running an affected version. The CVSS 3.1 score of 7.5 (network vector, no privileges required) indicates the attacker gains high confidentiality impact, with no integrity or availability impact. Any WordPress/WooCommerce site running the plugin at version 1.2.2 or older is affected. No public proof-of-concept, no known in-the-wild exploitation, and the vulnerability is not listed in CISA KEV.

Do: Update the plugin to the latest release (any version above 1.2.2) via the WordPress admin or the WordPress.org plugin directory. If an immediate update is not possible, deactivate the plugin until a patched version is available, since there is no public PoC or signature to detect attacks. Review access logs for unexpected unauthenticated requests to the site's AJAX/admin-post endpoints referencing this plugin.

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions.

CVE-2026-81431 is an improper privilege management flaw (CWE-269) in the Registration Form for WooCommerce WordPress plugin before version 1.1.3, which does not validate that the form referenced during registration is a legitimate registration form and instead reads the permitted-role allow-list from an arbitrary, attacker-controlled post. Any authenticated user with post-creation rights — Contributor role and above — can reference a crafted post during registration, bypassing the intended role restrictions and creating a new account with an arbitrary role, including Administrator. An attacker thereby gains full administrative control of the affected site (complete site takeover), with high impact on confidentiality, integrity, and availability. Sites running the plugin before 1.1.3 are affected, and because this is an incomplete fix of the earlier CVE-2026-54807, sites that applied that earlier patch may still be exposed. No public proof-of-concept or CISA KEV listing is known, and there is no confirmed exploitation in the wild as of this analysis.

Do: Upgrade the plugin to version 1.1.3 or later; because this is an incomplete fix of CVE-2026-54807, being on the earlier patched version is not sufficient. Until patched, restrict registration and post-creation privileges to trusted users and audit the users list for accounts created with elevated roles (especially Administrator) that could indicate prior exploitation. Also review registration activity for requests referencing non-registration posts, which is the telltale of this bypass.

CVE-2026-78361 is a critical missing-authorization flaw (CWE-862) in the zipMoney (Zip Co) Payments Plugin for WooCommerce, a WordPress payment gateway plugin. The plugin's front-end request handler performs no authorization checks and does not restrict which option name a caller may supply, so any unauthenticated visitor can send a crafted request that deletes an arbitrary WordPress option. By targeting key options such as the site URL or the list of active plugins, an attacker can destroy site and access-control configuration, deactivate every installed plugin, and take the site offline; the impact is limited to integrity and availability, with no confidentiality loss. Only WordPress sites running the plugin in a version prior to 2.4.0 are affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not listed in CISA's KEV.

Do: Update the plugin to version 2.4.0 or later. As an interim measure, block unauthenticated requests reaching the plugin's front-end handler (for example with WAF rules on the relevant action and option-name parameters) and confirm that critical options such as the site URL, home URL, and active-plugins list have not been deleted. Operators who notice unexpected site downtime or mass plugin deactivation should check for evidence of this option-deletion request pattern.

The Ultimate Gift Cards for WooCommerce WordPress plugin before version 3.2.10 lacks an authorization check when displaying gift card details, allowing any unauthenticated visitor to retrieve the gift cards attached to arbitrary orders. An attacker who can trigger this display for orders on a vulnerable store obtains customer personal data, gift card balances and dates; on version 3.2.9 the live redemption code is also exposed, which anyone holding it can redeem. Versions 3.0.3 through 3.2.8 disclose the same data but without the redemption code. Any WooCommerce store running the plugin in the affected range is exposed, with risk concentrated on stores that actively sell gift cards. There is no known public proof-of-concept and the flaw is not in CISA's KEV, so confirmed in-the-wild exploitation has not been reported.

Do: Upgrade Ultimate Gift Cards for WooCommerce to version 3.2.10 or later. Stores that ran version 3.2.9 should review gift card orders for unauthorized redemptions and consider reissuing any redemption codes that may have been exposed. As an interim mitigation, restrict unauthenticated requests to the plugin's gift card display functionality (e.g., via WAF rules) until the update is applied.

CVE-2026-19436 is a business-logic flaw (CWE-284) in the Ultimate Gift Cards for WooCommerce WordPress plugin, which issues gift card coupons to shoppers during checkout. The plugin fails to reconcile the value of the coupon it creates against the amount actually collected at checkout, so an unauthenticated shopper can complete a gift card purchase and receive store credit worth more than the payment they made, with no special conditions, privileges, or user interaction required. An attacker gains excess store credit or coupons on the affected store, which is a direct financial loss (revenue leakage) for the merchant rather than a code-execution or data-exposure issue, consistent with the integrity-only CVSS impact. Any WooCommerce store running the plugin before version 3.2.10 is affected. There is no public proof of concept, the flaw is not in CISA's KEV, and no exploitation is currently known.

Do: Update the plugin to version 3.2.10 or later, then review recently issued gift card coupons for value-versus-payment mismatches and signs of abuse. Until patched, disabling the gift card purchase/checkout flow is a practical stopgap. Even with no known public PoC, monitor order logs for unauthenticated gift card orders where the issued coupon value is disproportionate to the amount collected.

CVE-2026-15019 is an unauthenticated directory traversal vulnerability (CWE-22) in the Direct Download for WooCommerce WordPress plugin, affecting all versions up to and including 1.19, in the plugin's file-serving (include) logic. A remote, unauthenticated attacker can send a crafted request to the plugin's download endpoint with a path value that escapes the intended download directory; the plugin's ownership check only verifies that some free, virtual, downloadable product exists on the site, not that the requested path belongs to that product's configured downloads. This allows the attacker to read the contents of arbitrary files on the server, such as wp-config.php containing database credentials and authentication keys, with no modification of files or system state. Any WordPress/WooCommerce site running the plugin at version 1.19 or earlier and having at least one free, virtual, downloadable product is exploitable. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known as of this writing; severity is rated high (CVSS 3.1 7.5, confidentiality impact only).

Do: Update Direct Download for WooCommerce to the first release after 1.19 as soon as one is published (the source data confirms 1.19 is affected but does not name the patched version). Until an update is available, deactivate the plugin or apply a WAF/virtual-patch rule blocking directory-traversal sequences in its download request parameters. Site owners should check whether their catalog contains any free, virtual, downloadable product (which makes the site exploitable) and review access logs for unexpected requests to the plugin's download endpoint.

The Address Delete controller in Mageplaza's GDPR extension for Magento 2 (mageplaza/module-gdpr) through version 4.2.9 lacks an authorization check: it extends Magento's legacy Action class rather than AbstractAccount, so requests are not required to be authenticated, to belong to the address owner, or to carry a valid form key. An unauthenticated remote attacker can delete any customer's saved address by sending a GET request to /customer/address/delete/id/{id} with an arbitrary address ID. By iterating address IDs, the attacker can erase every stored customer address on the affected store; the impact is to data integrity only (CVSS C:N/I:H/A:N), with no data exposure or code execution. Any Magento 2 store running the affected Mageplaza GDPR module is exposed, with impact concentrated in loss of saved customer address records rather than site takeover. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is currently known.

Do: Check the installed mageplaza/module-gdpr version and upgrade to a release newer than 4.2.9 as soon as Mageplaza publishes a patched version. As an interim mitigation, block or require authentication for GET requests to /customer/address/delete/id/ at the web server or WAF level, and review access logs for unauthenticated hits to that endpoint to detect any address deletion already performed.

CVE-2026-79323 is an information disclosure flaw (CWE-200) in the blogComments GraphQL query of the Magefan Blog GraphQL extension (magefan/module-blog-graph-ql) for Magento 2. A remote, unauthenticated attacker can send a POST request to the store's /graphql endpoint invoking the blogComments query, which returns more data than it should. The attacker gains blog commenters' email addresses along with internal customer and admin account identifiers, with no privileges or user interaction required (CVSS 3.1: 7.5, high confidentiality impact). Any Magento 2 store running this module in version 2.2.1 or earlier is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known as of publication.

Do: Update magefan/module-blog-graph-ql to the first patched release after 2.2.1 (check Magefan's changelog) and deploy it with a standard composer update and cache flush. As an interim mitigation, restrict or disable unauthenticated access to the blogComments GraphQL query (e.g., via GraphQL introspection/field controls or edge rules) so commenter email addresses are not returned. Review web logs for unauthenticated POSTs to /graphql invoking blogComments and consider notifying commenters whose email addresses may have been exposed.

CVE-2026-79322 is an unauthenticated SQL injection (CWE-89) in the RelatedProduct block of Mageplaza Blog for Magento 2, affecting all versions through 4.3.2. A remote attacker can trigger it by sending a crafted id parameter to the /mpblog/post/view route, with no authentication or user interaction required. Successful exploitation permits execution of arbitrary SQL commands and reading of arbitrary database contents, which typically includes sensitive Magento data such as customer records, orders, and admin credentials, with limited additional integrity and availability impact per the CVSS vector. Any Magento 2 store running the Mageplaza Blog extension at version 4.3.2 or older, with blog routes reachable by unauthenticated visitors, is affected. The flaw is not currently in CISA's KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.

Do: Upgrade the Mageplaza Blog extension to the latest release, i.e., any version newer than 4.3.2, or apply the vendor patch when available. Until patched, mitigate by blocking or strictly validating the id parameter on /mpblog/post/view at the web application firewall, or by disabling the extension's blog routes. Review web and database logs for anomalous SQL activity tied to the blog route to check for prior exploitation.

Versions up to and including 3.35.0 of the YITH WooCommerce Waitlist Premium plugin for WordPress expose an AJAX handler (registered on the wp_ajax_yith_wcwtl_add_user action) that lacks both a capability check and nonce verification and imports attacker-controlled variables from $_POST['params'] using parse_str() and extract(). Because those variables are passed directly to wp_create_user() and $user->set_role(), any authenticated user with Subscriber-level access or higher can send a crafted request that creates a new user account with the administrator role. Successful exploitation gives the attacker full administrator-level control of the affected site, enabling plugin and content changes and further compromise. Only sites running the Premium edition of YITH WooCommerce Waitlist at version 3.35.0 or earlier are affected. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported at this time.

Do: Update YITH WooCommerce Waitlist Premium to the latest available release newer than 3.35.0, which restores the missing capability check and nonce verification on the yith_wcwtl_add_user AJAX action. Until patched, consider temporarily deactivating the plugin if your site does not depend on waitlists, and review subscriber accounts. After patching, audit the WordPress Users list and logs for newly created administrator accounts or unexpected role changes that could indicate attempted or successful exploitation.

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate an arbitrary attacker-hosted plugin, resulting in remote code execution on the server. The required nonce is emitted inline on all admin pages accessible to subscribers when WooCommerce is inactive, meaning any subscriber-level user can harvest it and trigger the exploit without any additional privileges.

The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.

The Next-Cart Store to WooCommerce Migration plugin for WordPress, in all versions up to and including 3.9.8, allows unauthenticated attackers to bypass authentication on its /wp-json/next_cart/v1/migration REST endpoint because the route has no permission requirement and the handler's token check falls back to the hardcoded value __token__ when the nextcart_token option has never been written to the database. This fallback condition occurs when the plugin is activated via WP-CLI, multisite network activation, or programmatically without a subsequent authenticated visit to wp-admin, since real token generation is deferred to admin_init; sites activated through wp-admin generate a real token and are not exposed. An unauthenticated attacker who supplies the literal string __token__ as the token reaches privileged handlers that pass attacker-controlled SQL directly to $wpdb->query() and $wpdb->get_results() and pass attacker-controlled paths to unlink(). Through these handlers an attacker can execute arbitrary SQL, including creating a new administrator account, and delete arbitrary files, enabling full site takeover. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not on the CISA KEV catalog.

Do: Sites running the plugin should update to a patched release newer than 3.9.8 as soon as the vendor ships one; until then, populate the nextcart_token option by visiting wp-admin once while authenticated after activation, or temporarily deactivate the plugin, since the hardcoded __token__ fallback is the core risk. Because exploitation enables arbitrary SQL execution and file deletion, also check affected sites for unexpected administrator accounts and missing or modified files.

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing any authenticated user, such as a subscriber, to redeem gift cards belonging to other users, zeroing their balance and crediting the value to themselves. In 3.2.9 an ownership check was added on one of the two affected redemption paths; the one that remains requires a companion Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 from the same vendor to be active.

CVE-2026-14962 is an unauthenticated SQL injection flaw (CWE-89) in the ELEX WooCommerce Request a Quote WordPress plugin, caused by insufficient sanitisation and escaping of a parameter before it is used in a SQL query. Because the vulnerable code path requires no authentication, any unauthenticated visitor to a site running the plugin can inject SQL through the affected parameter. Successful exploitation allows the attacker to extract arbitrary data from the WordPress database, which may include sensitive tables such as user accounts and order data; the CVSS scoring (8.6, confidentiality-high) indicates impact is limited to data disclosure, with no integrity or availability loss. Only WooCommerce stores running versions of the plugin before 2.4.1 are affected. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation is known.

Do: Sites running the ELEX WooCommerce Request a Quote plugin should upgrade to version 2.4.1 or later. If an immediate upgrade is not possible, consider virtual patching via a WAF (e.g., blocking SQL metacharacters in the vulnerable parameter) and monitor web/database logs for anomalous queries. Because exploitation may be silent, also review whether sensitive database content such as user credentials may have been accessed.

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the crafted request to target a page where a filter using the vulnerable recalculation output is present.

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Shop Manager writes the malicious payload once via the WooCommerce REST products endpoint (POST/PUT /wp-json/wc/v3/products/{id}), and the injected query executes on every subsequent public page view that renders the campaign rewards sidebar.

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and including, 1.31.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The $wpdb->prepare() call does not protect against this injection because the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() executes — prepare() only processes %s/%d placeholders and cannot sanitize content already embedded in the format string. REST API JSON bodies are parsed from php://input and bypass WordPress's wp_magic_quotes(), meaning double-quote characters in status array values reach the SQL sink unescaped. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The required 'mint_read_contacts' capability is a plugin-specific capability not assigned to any default WordPress role; it must be explicitly granted by an administrator, making this effectively an Administrator+ vulnerability.

The FireBox WordPress plugin (popup builder, exit-intent popups, email opt-in, and cart abandonment) is vulnerable to remote code execution through the value function in all versions up to and including 3.1.10. The Executer::allowedToRun() regex blacklist that gates which PHP functions may run is trivially bypassable — it fails to block core functions such as wp_insert_user, update_option, and file_put_contents — and PHP condition rule values saved through the firebox_meta REST endpoint are not sanitized. An authenticated attacker with author-level privileges or higher can therefore store and trigger crafted condition values that execute arbitrary code on the web server. On sites that were upgraded from a version prior to 3.1.10, the Migrator::preserveCampaignRoleAccess() function automatically granted the edit_fireboxes and publish_fireboxes capabilities to the Author role, widening the pool of accounts able to exploit the flaw. No public proof-of-concept is known and the vulnerability is not listed in CISA KEV, so exploitation status is currently none known.

Do: Update FireBox to a release newer than 3.1.10 as soon as a patched version is available. On sites upgraded from pre-3.1.10 versions, review the Author role (e.g., with a capabilities manager) and consider removing the automatically granted edit_fireboxes and publish_fireboxes capabilities until all author-level users are trusted, and audit the firebox_meta REST endpoint data for suspicious PHP condition values.