What is the CVSS score of CVE-2026-12736?

CVE-2026-12736 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Wpify Woo are affected by CVE-2026-12736?

The Wpify Woo WordPress plugin (versions 5.4.16 and earlier) contains a privilege escalation vulnerability allowing authenticated Shop Manager users to gain Administrator access and fully compromise…

How to fix or mitigate CVE-2026-12736?

Within 24 hours, audit all Shop Manager user accounts for legitimacy, revoke unnecessary access, and force password resets on all active Shop Manager users to prevent escalation attempts. Within 7 days, disable or restrict the vulnerable REST endpoint POST /wp-json/wpify-woo/v1/option via Web Application Firewall rules, firewall policies, or plugin configuration if operational requirements demand the plugin remains active. Within 30 days, either transition to an alternative WooCommerce plugin solution or completely remove Wpify Woo from all environments, while monitoring vendor security advisories for a patched version (watch for version 5.4.17 or later).

Wpify Woo CVE-2026-12736

EUVD-2026-48465 HIGH

Improper Privilege Management (CWE-269)

2026-07-24 Wordfence

GHSA-jp43-qmg3-xrhw

WordPress Privilege Escalation Wordpress Plugin Wpify Woo Withdrawal Crn Vat Qr Payments Heureka And More For Woocommerce

8.0

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Reachable via a single REST call so AC:L; requires Shop Manager/manage_woocommerce so PR:H; escalation to Administrator crosses the authorization scope so S:C with full C/I/A loss.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:02 vuln.today

CVE Published

Jul 24, 2026 - 02:32 cve.org

HIGH 8.0

DescriptionCVE.org

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).

AnalysisAI

Privilege escalation in the Wpify Woo WordPress plugin (versions ≤ 5.4.16) lets authenticated Shop Manager users overwrite arbitrary WordPress options and promote themselves to Administrator. The vulnerable SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) forwards attacker-controlled 'option' and 'data' values straight into update_option() with no allowlist or sanitization, gated only by the manage_woocommerce capability. Reported by Wordfence with a CVSS of 8.0; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

Wpify Woo is a WooCommerce extension bundling EU/Czech-market features (withdrawal, CRN/VAT validation, QR payments, Heureka integration). The flaw is a CWE-269 Improper Privilege Management issue in its REST API: ApiManager registers routes whose permission_callback only checks current_user_can('manage_woocommerce'), a capability held by Shop Managers and Administrators. The save_option() handler treats the client-supplied 'option' name and 'data' value as trusted and calls WordPress core update_option($option, $data) with neither an option-name allowlist nor value sanitization. Because update_option() can write ANY row in wp_options, a caller can mutate security-critical globals such as default_role, users_can_register, and active_plugins. The affected code is visible in trac tags 5.4.9/5.4.10 at src/Api/SettingsApi.php and src/Managers/ApiManager.php.

RemediationAI

Update the Wpify Woo plugin to the first release above 5.4.16 that contains the fix; the repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3614762%40wpify-woo&new=3614762%40wpify-woo shows the upstream correction, but an exact tagged patched version is not independently confirmed from the provided data, so verify the installed version against the Wordfence advisory before deploying. Until patched, restrict who holds Shop Manager and manage_woocommerce - audit and remove unnecessary staff accounts, since the flaw is only reachable by those roles. As a compensating control, block or require additional authentication on POST /wp-json/wpify-woo/v1/option at a WAF or reverse proxy (side effect: legitimate plugin settings saves through this REST route will break, so scope the rule to untrusted sources), and monitor wp_options for unexpected changes to default_role, users_can_register, and active_plugins. Confirm details via https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b8f2d5-a2c5-4f90-ab1d-4e17f7a7996e?source=cve