Productive Commerce CVE-2026-109926

Exploitation requires (1) the Productive Commerce plugin installed and active at a version before 1.1.49, and (2) the attacker possessing any authenticated account on the site - even the lowest 'subscriber' role suffices (PR:L). The specific enabling defect is twofold: the vulnerable AJAX action omits a capability check, and the nonce that is supposed to guard it is rendered on every admin-area page, so any logged-in user can retrieve it. Limiting factors: an account is mandatory (not anonymous/unauthenticated), so sites that disable open user registration substantially reduce exposure; impact is bounded to activating plugins that are ALREADY installed on the site (the attacker cannot upload new plugins via this flaw alone).

This is a moderate, authenticated authorization flaw (CWE-862 Missing Authorization) rather than a top-priority emergency. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3 Medium) is internally consistent with the description: network reachable, low complexity, but requires an existing low-privilege account (PR:L, e.g. a subscriber) and yields only limited integrity impact (I:L) with no confidentiality or availability loss. Publicly available exploit code exists (reported by WPScan), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation - the POC signal and the absence of KEV are not in conflict, they simply indicate exploitability is proven while real-world exploitation is unconfirmed. The main caveat: the impact ceiling may exceed I:L in practice, because the ability for a subscriber to activate arbitrary already-installed plugins can be chained (activating a vulnerable or attacker-staged plugin could escalate toward code execution), so treat I:L as a conservative floor. Key limiter is that exploitation requires a pre-existing authenticated account on the target site.

An attacker registers or already holds a low-privilege WordPress account (such as a subscriber) on a site running Productive Commerce before 1.1.49. Because the guarding nonce is exposed on every admin-area page and the AJAX handler performs no capability check, the attacker reads the nonce and replays the AJAX request to activate an arbitrary plugin already installed on the site. A public proof-of-concept for this flow exists via WPScan, making exploitation straightforward.