#WooCommerce
All CosmicBytez Labs articles tagged #WooCommerce, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-87855: JTL-Connector for WooCommerce Arbitrary File Upload
Unauthenticated arbitrary file upload in JTL-Connector for WooCommerce (≤ 2.4.3) via saveImage() enables webshell upload and RCE.
- Security
CVE-2026-97657: Abandoned Cart Pro for WooCommerce Authentication Bypass
Malleable AES-CTR encryption and a bypassable HMAC let attackers forge cart-recovery tokens and take over any WooCommerce account.
- Security
CVE-2026-97668: Abandoned Cart Pro for WooCommerce Unauthenticated SQL Injection
Unauthenticated SQL injection in Abandoned Cart Pro's guest-cart meta_value lets attackers read data and escalate to full admin takeover.
- Security
CVE-2026-103695: Unauthenticated SQL Injection in Mobile Builder's vendor_id Parameter
Mobile builder ≤ 1.4.2 fails to sanitize the vendor_id parameter, letting unauthenticated attackers run SQL injection attacks.
- Security
CVE-2026-104398: Critical Object Injection in WooCommerce AFFI Affiliate Marketing Plugin
A deserialization flaw in VillaTheme's AFFI WooCommerce plugin allows unauthenticated PHP object injection, risking full site takeover.
- Security
CVE-2026-14854: Unauthenticated Memory-Exhaustion DoS in WooCommerce Bookings
WooCommerce Bookings before 3.11.0 lets unauthenticated attackers exhaust server memory with a single unbounded AJAX request.
- Security
CVE-2026-103889: Unauthenticated RCE in 3D Product Configurator for WooCommerce
An unauthenticated attacker can POST a malicious xpv_image payload to the WooCommerce 3D Product Configurator plugin for RCE (CVSS 9.8).
- Security
CVE-2026-107645: Blocksy Companion Disables Dokan's Nonce Check for Unauthenticated Vendor Takeover
An AJAX handler in Blocksy Companion disables Dokan's nonce check, letting unauthenticated attackers auto-register as a vendor (CVSS 9.1).
- News
Ninja Forms and WPC Product Bundles Flaws Exploited to Backdoor WordPress Sites
Attackers are chaining stored XSS bugs in Ninja Forms and WPC Product Bundles for WooCommerce to plant hidden admins and backdoors on 530,000+ sites.
- Security
CVE-2026-92244: Unauthenticated Stored XSS in WooCommerce PDF Invoices Plugin
High-severity stored XSS (CVSS 7.2) in PDF Invoices & Packing Slips for WooCommerce, 300K+ sites, triggered via guest checkout fields.
- Security
CVE-2026-14281: Unauthenticated Admin Takeover in WAWP WooCommerce Plugin
Missing REST permission checks in the WAWP plugin (≤4.8.6) let anyone register as a WordPress administrator via signup. CVSS 9.8, PoC public.
- Security
CVE-2026-82187: Unauthenticated Arbitrary File Upload in Web to Print Online Designer
A WooCommerce plugin used by print shops fails to validate uploads and leaks its own protection token, enabling unauthenticated RCE.
- News
Hackers Exploit Critical WooCommerce Wholesale Lead Capture Flaw to Plant PHP Backdoors
Hackers exploit a critical flaw in the WooCommerce Wholesale Lead Capture plugin to upload PHP backdoors; Wordfence has blocked 100,000+ attacks.
- Security
Unauthenticated SQL Injection in WCFM Marketplace ≤ 3.8.1
A critical unauthenticated SQL injection (CVSS 9.3) in the WCFM Marketplace WordPress plugin exposes vendor and customer database records.
- Security
Unauthenticated Privilege Escalation to Admin in WooCommerce Plugin (CVE-2026-15369)
CVE-2026-15369 (CVSS 9.8) lets unauthenticated attackers self-assign the Administrator role during WooCommerce checkout in Addify's plugin.
- Security
Total Processing Card Payments for WooCommerce: Unauthenticated SSRF Enables Payment Verification Forgery
CVE-2026-16947 (CVSS 9.1) lets attackers redirect payment verification requests and forge success responses on WooCommerce stores.
- Security
CVE-2026-16576: Dokan WooCommerce Plugin Privilege Escalation to RCE
A missing capability check in the Dokan multivendor WooCommerce plugin allows Shop Managers to install arbitrary plugins, leading to full site compromise.
- Security
CVE-2026-15002: Stored XSS in Autopay WooCommerce Plugin for WordPress
CVE-2026-15002 is a stored XSS flaw (CVSS 7.2) in the Autopay WooCommerce plugin, letting attackers inject persistent scripts via the CSS editor POST parameter.
- Security
CVE-2026-28154: Reflected XSS in WooCommerce WordPress Themes
High-severity reflected XSS in Samex and M.Anh WooCommerce themes allows attackers to inject malicious scripts via crafted URLs.
- Security
CVE-2026-14182: WooCommerce Email Verification Bypass Allows Account Takeover
A CVSS 9.8 type juggling flaw in Customer Email Verification for WooCommerce lets unauthenticated attackers take over any customer account.
- Security
CVE-2026-28005: Critical Privilege Escalation in Kadence WooCommerce Email Designer
A critical unauthenticated privilege escalation flaw (CVSS 9.8) in Kadence WooCommerce Email Designer <= 1.5.19 allows attackers to gain admin access with...
- Security
CVE-2026-8457: WooCommerce Social Login Authentication Bypass (CVSS 9.8)
A critical authentication bypass vulnerability in the WooCommerce - Social Login WordPress plugin allows unauthenticated attackers to log in as any...
- Security
CVE-2026-15414: WooCommerce Subscriptions Plugin Privilege Escalation (CVSS 8.8)
A high-severity privilege escalation vulnerability in the Subscriptions for WooCommerce plugin allows authenticated users to elevate their role to...
- Security
CVE-2026-15397: Missing Authorization in Subscriptions for WooCommerce Plugin
A missing authorization vulnerability in the Subscriptions for WooCommerce plugin allows authenticated users with minimal privileges to perform...
- Security
CVE-2025-10656: WooCommerce Plugin Missing Authorization Allows Unauthenticated Admin Account Creation
A critical missing authorization vulnerability in the Spreadsheet Price Changer for WooCommerce plugin allows unauthenticated attackers to create admin...
- Security
CVE-2026-13714: Realtyna IDX Plugin Unauthenticated File Upload via Hardcoded Credentials
A critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Realtyna Organic IDX + WPL Real Estate WordPress plugin (before v5.3.0)...
- Security
CVE-2026-14289: FacturaONE WooCommerce Plugin Allows Unauthenticated File Write
A critical unauthenticated arbitrary file write vulnerability in the FacturaONE para WooCommerce con VeriFactu plugin (before v5.37) allows attackers to...
- Security
CVE-2026-15103: WPFunnels Plugin Privilege Escalation via Unauthenticated REST Endpoint
A high-severity privilege escalation flaw in WPFunnels for WordPress allows attackers to update arbitrary site options via an unvalidated REST callback,...
- Security
CVE-2026-12492: WooCommerce OTP Login Plugin Auth Bypass — Full Admin Takeover
The Happy Coders OTP Login for WooCommerce plugin before 2.8 allows unauthenticated attackers to bypass OTP verification and log in as any WordPress user,...
- Security
CVE-2026-9725: Critical WordPress WooCommerce Plugin File Deletion
A CVSS 9.1 critical unauthenticated arbitrary file deletion vulnerability in the Printcart Web to Print Product Designer for WooCommerce plugin affects...
- Security
CVE-2026-49777: CVSS 10 Flaw in WooCommerce Product Slider Pro Enables Malware Implantation
A maximum-severity input validation vulnerability in Product Slider Pro for WooCommerce allows attackers to implant malicious software. Affects all versions…
- Security
CVE-2025-15609: Fortis for WooCommerce Plugin Leaks API
The Fortis for WooCommerce WordPress plugin before version 1.3.1 exposes sensitive API keys to unauthenticated attackers, enabling unauthorized access to...
- News
Funnel Builder Flaw Under Active Exploitation Enables
Attackers are actively exploiting a critical vulnerability in the Funnel Builder WordPress plugin to inject malicious JavaScript into WooCommerce checkout...
- News
Funnel Builder WordPress Plugin Bug Exploited to Steal
A critical vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript into WooCommerce checkout...
- Security
Critical Auth Bypass in InfusedWoo Pro Enables
A CVSS 9.1 authorization bypass in InfusedWoo Pro for WordPress lets unauthenticated attackers permanently delete arbitrary data across all installations...
- Security
CVE-2026-4896: WCFM WooCommerce Plugin IDOR Allows
A high-severity Insecure Direct Object Reference vulnerability in the WCFM Frontend Manager for WooCommerce plugin (up to v6.7.25) lets authenticated...
- Security
CVE-2026-3589: WooCommerce CSRF Flaw Allows Unauthenticated
A cross-site request forgery vulnerability in WooCommerce versions 5.4.0 through 10.5.2 allows attackers to abuse the Store API's batch endpoint to...