CVE-2026-49110
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In WooCommerce versions up to 3.1.4, there is a vulnerability of unauthenticated broken authentication in the Upsell Order Bump Offer feature.
Risk Assessment
An attacker could exploit this vulnerability to perform unauthorized actions within the system, potentially leading to data loss or unauthorized transactions.
Recommendation
It is recommended to update WooCommerce to the latest version to mitigate this vulnerability.
Other vulnerabilities in WooCommerce
See all- CVE-2022-50972Critical
WooCommerce version 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter.
- CVE-2026-54807Critical
There is an unauthenticated privilege escalation vulnerability in the registration form for WooCommerce versions <= 1.0.9.
- CVE-2026-42386Critical
WooCommerce versions up to 4.5.1 contain a vulnerability for unauthenticated SQL injection in the order delivery date field.
- CVE-2024-1310Medium
The WooCommerce WordPress plugin before version 8.6 fails to prevent users with at least the contributor role from leaking products they should not have access to, such as private, draft, and trashed products.
Original NVD description (English source)
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.