What is the CVSS score of CVE-2026-12736?

CVE-2026-12736 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-12736?

Within 24 hours, audit all Shop Manager user accounts for legitimacy, revoke unnecessary access, and force password resets on all active Shop Manager users to prevent escalation attempts. Within 7 days, disable or restrict the vulnerable REST endpoint POST /wp-json/wpify-woo/v1/option via Web Application Firewall rules, firewall policies, or plugin configuration if operational requirements demand the plugin remains active. Within 30 days, either transition to an alternative WooCommerce plugin solution or completely remove Wpify Woo from all environments, while monitoring vendor security advisories for a patched version (watch for version 5.4.17 or later).

Wpify Woo CVE-2026-12736

EUVD-2026-48465 HIGH

Improper Privilege Management (CWE-269)

2026-07-24 Wordfence

GHSA-jp43-qmg3-xrhw

WordPress Privilege Escalation Wordpress Plugin Wpify Woo Withdrawal Crn Vat Qr Payments Heureka And More For Woocommerce

8.0

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as Shop Manager (manage_woocommerce)
Delivery

POST option/data to /wp-json/wpify-woo/v1/option
Exploit

update_option overwrites default_role & users_can_register
Execution

Register self-service account
Persist

Account auto-granted Administrator
Impact

Full site takeover

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires an authenticated WordPress account with Shop Manager-level access or above (specifically the manage_woocommerce capability), and the Wpify Woo plugin ≤ 5.4.16 installed and active so the /wp-json/wpify-woo/v1/option REST route is registered. Exploitation is limited by that privilege requirement (PR:H) - anonymous or Subscriber/Customer users cannot reach it - but needs no user interaction, no non-default configuration, and works against a default plugin install. Practical risk is highest on multi-staff stores or where a Shop Manager credential can be phished or reused.
Impact	The published CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H = 8.0) captures the high impact and scope change of a role escalation, but its AC:H rating overstates difficulty - overwriting an option is a single well-formed REST call, so AC:L is more defensible. PR:H is appropriate because exploitation requires an existing Shop Manager (manage_woocommerce) account, which meaningfully limits the attacker population to trusted-ish insiders or a compromised staff credential rather than anonymous internet attackers. No EPSS score, POC, or SSVC decision was supplied, and the CVE is not in CISA KEV, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: genuinely high-impact (full site takeover) but gated behind a privileged role, making it a strong priority for sites with multiple store staff or delegated management, and a lower priority for single-admin stores. Missing signals (EPSS, exact patched version) should be confirmed with the vendor/Wordfence advisory.
Exploit ScenarioDerived	A malicious or compromised Shop Manager sends a single authenticated POST to /wp-json/wpify-woo/v1/option setting default_role to 'administrator' and users_can_register to 1, then registers a new account that is automatically granted Administrator, achieving full site takeover. No public POC is identified, but the attack is a trivial authenticated REST call given the required role.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Privilege escalation in the Wpify Woo WordPress plugin (versions ≤ 5.4.16) lets authenticated Shop Manager users overwrite arbitrary WordPress options and promote themselves to Administrator. The vulnerable SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) forwards attacker-controlled 'option' and 'data' values straight into update_option() with no allowlist or sanitization, gated only by the manage_woocommerce capability. Reported by Wordfence with a CVSS of 8.0; no public exploit identified at time of analysis and not listed in CISA KEV.

RemediationAI

Update the Wpify Woo plugin to the first release above 5.4.16 that contains the fix; the repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3614762%40wpify-woo&new=3614762%40wpify-woo shows the upstream correction, but an exact tagged patched version is not independently confirmed from the provided data, so verify the installed version against the Wordfence advisory before deploying. Until patched, restrict who holds Shop Manager and manage_woocommerce - audit and remove unnecessary staff accounts, since the flaw is only reachable by those roles. As a compensating control, block or require additional authentication on POST /wp-json/wpify-woo/v1/option at a WAF or reverse proxy (side effect: legitimate plugin settings saves through this REST route will break, so scope the rule to untrusted sources), and monitor wp_options for unexpected changes to default_role, users_can_register, and active_plugins. Confirm details via https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b8f2d5-a2c5-4f90-ab1d-4e17f7a7996e?source=cve

Affected VersionsENISA

WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce 0 ≤5.4.16

Affected Packages

euvd wpify_woo_withdrawal_crn_vat_qr_payments_heureka_and_more_for_woocommerce no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Wpify Woo is a WooCommerce extension bundling EU/Czech-market features (withdrawal, CRN/VAT validation, QR payments, Heureka integration). The flaw is a CWE-269 Improper Privilege Management issue in its REST API: ApiManager registers routes whose permission_callback only checks current_user_can('manage_woocommerce'), a capability held by Shop Managers and Administrators. The save_option() handler treats the client-supplied 'option' name and 'data' value as trusted and calls WordPress core update_option($option, $data) with neither an option-name allowlist nor value sanitization. Because update_option() can write ANY row in wp_options, a caller can mutate security-critical globals such as default_role, users_can_register, and active_plugins. The affected code is visible in trac tags 5.4.9/5.4.10 at src/Api/SettingsApi.php and src/Managers/ApiManager.php.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI 9.1 CRITICAL

Reachable via a single REST call so AC:L; requires Shop Manager/manage_woocommerce so PR:H; escalation to Administrator crosses the authorization scope so S:C with full C/I/A loss.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).

Executive ViewAI

Why It Matters

The Wpify Woo WordPress plugin (versions 5.4.16 and earlier) contains a privilege escalation vulnerability allowing authenticated Shop Manager users to gain Administrator access and fully compromise the e-commerce environment. No public exploit has been identified at time of analysis, but the vulnerability poses an immediate insider threat risk-compromised employee credentials or malicious shop managers can escalate to complete site control with access to customer data. The absence of a vendor-released patch makes this an urgent security risk requiring immediate defensive action.

Business Impact: High

Compensating Controls

Immediately disable or restrict access to the vulnerable endpoint /wp-json/wpify-woo/v1/option via Web Application Firewall or firewall rules; audit and minimize the number of Shop Manager accounts; implement enhanced logging and alerting for WordPress options table modifications; restrict Shop Manager role capabilities in WordPress configuration where feasible.

Threat Intelligence Overview

EPSS Score

0.3%

Top 74% exploitable

Prevalence

Low

niche EU/Czech-market WooCommerce add-on, limited enterprise footprint

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.