CVE-2026-57377

MediumCVSS 6.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

25th percentile - higher than 25% of all known CVEs

Summary

The WowAddons plugin for WordPress has a missing authorization vulnerability in the product-addons feature, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.6.8.

Risk Assessment

An attacker can gain unauthorized access to product addon functionality, potentially modifying or stealing data, compromising system integrity and confidentiality.

Recommendation

It is recommended to immediately update the WowAddons plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in WowAddons

CVE-2026-57686High
The WowAddons plugin version 1.6.14 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.

Original NVD description (English source)

Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowAddons: from n/a through <= 1.6.8.