WooCommerce CVE-2026-106608

Exploitation requires the attacker to already possess an authenticated high-privilege WooCommerce/WordPress account (CVSS PR:H) on a store running WooCommerce 9.8.0 through 11.1.2 - this is the primary limiting factor and excludes anonymous internet attackers. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once such an account exists the escalation is straightforward over the network. The flaw is an Incorrect Privilege Assignment (CWE-266) that lets an elevated-but-non-admin role acquire capabilities it should not have; the specific feature, role, or endpoint abused is not detailed in the provided description, so the exact privileged workflow should be confirmed against the Patchstack advisory. Stores that only issue administrator accounts to fully trusted operators have a materially smaller realistic attack surface than multi-vendor or staffed stores.

This is a genuine but conditional priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH) signals a network-reachable, low-complexity flaw with full confidentiality/integrity/availability impact, but it explicitly requires high privileges (PR:H) - meaning an attacker must already hold an elevated authenticated role before exploitation. No EPSS probability, CISA KEV listing, or public POC was supplied in the intelligence, so exploitation likelihood cannot be quantified from the input and there is no evidence of active or automated exploitation. The real-world concern is amplified by WooCommerce's enormous deployment footprint and the privilege-escalation outcome (CWE-266, Incorrect Privilege Assignment), which lets an already-trusted-but-limited account gain broader control; however, the PR:H precondition meaningfully narrows the attacker population versus an unauthenticated RCE. Net: treat as a HIGH-priority patch for any WooCommerce store that grants back-end roles to semi-trusted users (multi-vendor, staff, subscriber-shop setups), but lower urgency where only trusted administrators have accounts. Note a possible tension to verify: PR:H combined with S:U and full C/I/A impact is somewhat unusual for a pure privilege-escalation issue - confirm the exact starting role and target role with Patchstack/Automattic.

An attacker who already holds a high-privilege but non-administrator WooCommerce/WordPress account (for example a shop manager or vendor role on a multi-seller store) sends crafted authenticated requests that abuse the plugin's incorrect privilege assignment logic to grant themselves capabilities beyond their intended role. Because the CVSS complexity is low and no user interaction is needed, the action is reliable once the attacker is authenticated. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector and CWE-266 rather than from a published POC.