What is the CVSS score of CVE-2026-11568?

CVE-2026-11568 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Product Configurator for WooCommerce are affected by CVE-2026-11568?

The Product Configurator for WooCommerce plugin (versions before 1.7.3) allows unauthenticated attackers to access sensitive product information including pricing, inventory status, and configurator…. A patch is available.

Is there a public PoC exploit available for CVE-2026-11568?

Yes, a public proof-of-concept exploit is available for CVE-2026-11568. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-11568?

Within 24 hours: Identify all WordPress sites running Product Configurator for WooCommerce plugin versions prior to 1.7.3. Within 7 days: Update all affected installations to version 1.7.3 or later. Within 30 days: Review access logs and transaction patterns for any exploitation targeting private or draft products, and assess scope of potential data exposure.

Product Configurator for WooCommerce CVE-2026-11568

EUVD-2026-40916 HIGH

2026-07-01 WPScan

GHSA-x525-xmpm-prq9

WordPress Authentication Bypass Product Configurator For Woocommerce Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Remote unauthenticated, low complexity (AV:N/AC:L/PR:N/UI:N), but confidentiality impact is limited to a bounded set of product fields, so C:L not C:H; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 11:22 vuln.today

CVSS changed

Jul 01, 2026 - 11:22 NVD

7.5 (HIGH)

Patch available

Jul 01, 2026 - 08:01 EUVD

CVE Published

Jul 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX action, allowing unauthenticated users to retrieve the data (title, price, weight, stock status, and configurator option pricing/SKUs) of private and draft, non-public products by supplying the product ID. WordPress post-visibility controls are bypassed.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 2 Critical, 14 High, 4 With POC Jul 02, 2026

AnalysisAI

Unauthenticated information disclosure in the Product Configurator for WooCommerce WordPress plugin (versions before 1.7.3) exposes sensitive product data through a public AJAX action that skips authorization and post-status checks. By supplying only a product ID, remote unauthenticated users can read titles, prices, weights, stock status, and configurator option pricing/SKUs of private and draft products, bypassing WordPress post-visibility controls. Publicly available exploit code exists (reported by WPScan), though there is no indication of active exploitation.

Technical ContextAI

The affected component is a WooCommerce extension for WordPress that adds configurable product options (variant pricing, SKUs) to storefronts. WordPress plugins commonly register AJAX handlers via wp_ajax_nopriv_* hooks, which are reachable by unauthenticated visitors; the secure pattern requires the handler to independently verify capability and to honor the product's post_status (publish vs private/draft). Here the handler returns WooCommerce product objects without a capability check or a post-status gate, so the plugin's own logic overrides WordPress's built-in visibility model. The root cause class is Missing Authorization / Improper Access Control (CWE-862/CWE-285); the input CWE field is N/A, so this classification is inferred from the description rather than vendor-assigned. The single CPE provided (cpe:2.3:a:unknown:product_configurator_for_woocommerce:*) covers all versions up to the fix, with the vendor recorded as 'unknown'.

RemediationAI

Vendor-released patch: 1.7.3 - upgrade the Product Configurator for WooCommerce plugin to version 1.7.3 or later, which is the primary and recommended fix. If immediate upgrade is not possible, compensating controls include placing the site's admin-ajax.php endpoint behind a WAF rule that blocks the specific plugin AJAX action for unauthenticated requests (trade-off: requires identifying the exact action name and risks breaking legitimate front-end configurator calls), restricting or removing draft/private products of genuine sensitivity from the live store until patched (trade-off: operational overhead and loss of staging-on-production workflows), or temporarily deactivating the plugin if the configurator feature is non-essential (trade-off: configurable product functionality is lost). Consult the WPScan advisory (https://wpscan.com/vulnerability/e208fee5-dad5-4aeb-b9b5-fbd72a5633e4/) for authoritative guidance and monitor access logs for enumeration of sequential product IDs against admin-ajax.php.