Description
The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Automattic | WooCommerce | >= 5.4.0, < 5.4.4; >= 5.5.0, < 5.4.5; >= 5.6.0, < 5.6.3; >= 5.7.0, < 5.7.3; >= 5.8.0, < 5.8.2; >= 5.9.0, < 5.9.2; >= 6.0.0, < 6.0.2; >= 6.1.0, < 6.1.3; >= 6.2.0, < 6.2.3; >= 6.3.0, < 6.3.2; >= 6.4.0, < 6.4.2; >= 6.5.0, < 6.5.2; >= 6.6.0, < 6.6.2; >= 6.7.0, < 6.7.1; >= 6.8.0, < 6.8.3; >= 6.9.0, < 6.9.5; >= 7.0.0, < 7.0.2; >= 7.1.0, < 7.1.2; >= 7.2.0, < 7.2.4; >= 7.3.0, < 7.3.1 |
References
Timeline
- Published
- Mar 6, 2026
- Last modified
- Jun 17, 2026
- NVD status
- Deferred