CVE-2026-12736
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options.
Risk Assessment
Risk of privilege escalation by authenticated users with Shop Manager level, potentially leading to full control of the WordPress site.
Recommendation
Update the Wpify Woo plugin to version 5.4.17 or later.
Related vulnerabilities
- CVE-2026-82688Critical
D-Link DNS-340L and DNS-345 (versions 1.01B04/1.03B06/1.04.B02/1.05b04) have a vulnerability in /cgi-bin/virtual_vol.cgi (Virtual Volume Handler). Manipulation of arguments f_sharename/f_target/f_name leads to OS command injection. Remote exploitation is possible, and the exploit has been publicly disclosed.
- CVE-2026-49003Critical
Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash. They can also gain root privileges to steal configuration passwords (e.g., SNMP) and tamper with critical system parameters, leading to abnormal operation of the entire power system.
- CVE-2026-82874Critical
ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across tenant boundaries. Attackers can extract victim organization IDs from public app endpoints, then exploit schema operation endpoints to disclose schemas, plant malicious tables, corrupt schemas, or permanently destroy data.
- CVE-2026-82872Critical
ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in table-management API requests.
- CVE-2026-82870Critical
ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.
- CVE-2026-82860Critical
@hulumi/policies before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.
- CVE-2026-82859Critical
hulumi before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.
- CVE-2026-82858Critical
@hulumi/drift before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.
- CVE-2026-82857Critical
A privilege escalation vulnerability in hulumi before v1.3.2 exists in the weekly integration IAM policy, allowing role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.
- CVE-2026-82856Critical
A vulnerability in @hulumi/policies before 1.3.2 fails to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.
Original NVD description (English source)
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).