What is the CVSS score of CVE-2026-11364?

CVE-2026-11364 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Product Specifications WooCommerce CVE-2026-11364

EUVD-2026-39951 MEDIUM

Missing Authorization (CWE-862)

2026-06-27 Wordfence

GHSA-jw2p-w93r-295r

WordPress Authentication Bypass Wordpress Plugin Product Specifications For Woocommerce

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via AJAX (AV:N), requires subscriber authentication (PR:L), affects only taxonomy data integrity with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 27, 2026 - 07:55 vuln.today

CVE Published

Jun 27, 2026 - 06:50 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data in versions up to and including 0.8.9. This is due to a missing capability check and missing nonce verification in the __invoke() methods of the AttributeGroupController and AttributeController classes, which are bound to the 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create, edit, and delete arbitrary product specification groups and attributes (taxonomy terms in the 'spec-group' and attribute taxonomies), corrupting business data and impacting the site's frontend display.

AnalysisAI

Unauthorized taxonomy manipulation in the Product Specifications for WooCommerce WordPress plugin (versions up to and including 0.8.9) exposes AJAX endpoints that any authenticated subscriber can invoke without authorization checks or CSRF protection, enabling arbitrary creation, modification, and deletion of product specification groups and attributes. The affected AJAX actions 'dwps_modify_groups' and 'dwps_modify_attributes' - bound to the __invoke() methods of AttributeGroupController and AttributeController - operate on 'spec-group' and attribute taxonomy terms, meaning successful exploitation directly corrupts WooCommerce store business data and breaks frontend product display. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.

Technical ContextAI

The vulnerability resides in a WordPress plugin (CPE: cpe:2.3:a:dornaweb:product_specifications_for_woocommerce:*:*:*:*:*:*:*:*) by Dornaweb that extends WooCommerce with structured product specification management via custom taxonomies ('spec-group' and attribute). The plugin registers AJAX hooks ('dwps_modify_groups', 'dwps_modify_attributes') that invoke the __invoke() magic methods in AttributeGroupController.php (line 13) and AttributeController.php (line 18), as confirmed by WordPress plugin trac source references. CWE-862 (Missing Authorization) identifies the root cause: neither a WordPress capability check (e.g., current_user_can('manage_product_terms')) nor a nonce verification (wp_verify_nonce()) is performed before executing taxonomy write operations. This dual omission - missing both authorization and CSRF protection - means any logged-in user can trigger privileged data mutation endpoints directly via wp-admin/admin-ajax.php.

RemediationAI

Update the Product Specifications for WooCommerce plugin to the latest available version beyond 0.8.9; a fix changeset has been committed to the WordPress plugin repository (referenced at plugins.trac.wordpress.org/changeset with changeset 3580068), though the exact released fixed version number is not independently confirmed from the provided data - verify the current version in the WordPress plugin directory before updating. As a compensating control while a patched version is confirmed, site administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent unauthenticated parties from obtaining subscriber accounts; note this may impact legitimate onboarding workflows. Alternatively, a WAF rule blocking POST requests to wp-admin/admin-ajax.php where the 'action' parameter equals 'dwps_modify_groups' or 'dwps_modify_attributes' from non-administrative sessions can block exploitation, though this may break intended plugin functionality for legitimate administrative use. Review existing subscriber-level user accounts for unauthorized modifications to product specification taxonomy terms.