CVE-2026-61958
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The License Manager for WooCommerce WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.0.17.
Risk Assessment
An attacker can gain unauthorized access to license management functions, potentially leading to data integrity breaches and privilege escalation in the WooCommerce store.
Recommendation
Immediately update the License Manager for WooCommerce plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in License Manager for WooCommerce
See all- CVE-2026-73345High
SQL Injection vulnerability in License Manager for WooCommerce versions up to 3.0.18. An attacker can inject malicious SQL code through the customer field.
- CVE-2026-56013Medium
The License Manager for WooCommerce plugin version 3.0.15 and earlier contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability. This allows an attacker to access sensitive data without requiring authentication.
Original NVD description (English source)
Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.17.