CVE-2026-118072

MediumCVSS 5.4/10Last modified Oct 30, 2026

Description

The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
UnknownFraud Prevention For WooCommerce and EDD< 2.3.6

References

Timeline

Published
Oct 30, 2026
Last modified
Oct 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1180738.8Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.CVE-2026-1180747.2Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.CVE-2026-1180758.8Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.CVE-2026-1180768.8Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.CVE-2026-1180777.2Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.CVE-2026-1180787.2Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.CVE-2026-1180797.2Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.ThCVE-2026-1180808.8Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.CVE-2026-1180818.8Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.CVE-2026-1180828.8Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.CVE-2026-1180837.5Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.CVE-2026-1180846.5Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
CVE-2026-118072: Medium severity, CVSS 5.4 | Vulnix