What is the CVSS score of CVE-2026-31921?

CVE-2026-31921 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Product Rearrange For Woocommerce are affected by CVE-2026-31921?

CVE-2026-31921 presents notable security risk, a missing authorization vulnerability rated CVSS 8.2.

How to fix or mitigate CVE-2026-31921?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Product Rearrange For Woocommerce CVE-2026-31921

EUVD-2026-15819 HIGH

Missing Authorization (CWE-862)

2026-03-25 Patchstack

WordPress Authentication Bypass Product Rearrange For Woocommerce Wordpress Plugin

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15819

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.2

DescriptionCVE.org

Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.

AnalysisAI

A missing authorization vulnerability exists in the Devteam HaywoodTech Product Rearrange for WooCommerce plugin (versions up to 1.2.2) that allows attackers to exploit incorrectly configured access control security levels. This broken access control flaw (CWE-862) enables unauthorized users to manipulate product ordering in WooCommerce stores without proper authentication or authorization checks. The vulnerability affects all installations of the plugin through version 1.2.2 and has been documented by Patchstack with EUVD tracking ID EUVD-2026-15819, though CVSS scoring and POC availability status are not publicly detailed.

Technical ContextAI

Product Rearrange for WooCommerce is a WordPress plugin developed by Devteam HaywoodTech (identifiable via CPE cpe:2.3:a:devteam_haywoodtech:product_rearrange_for_woocommerce) that allows administrators to reorder products within a WooCommerce store. The vulnerability represents a classic broken access control issue classified under CWE-862 (Missing Authorization), meaning the plugin fails to properly verify user permissions before allowing product rearrangement operations. This is a server-side authorization flaw where sensitive endpoints lack adequate capability checks, allowing unauthenticated or lower-privileged users to perform administrative product management functions that should be restricted to store administrators.

RemediationAI

The primary remediation is to upgrade Product Rearrange for WooCommerce to a patched version greater than 1.2.2 as soon as it becomes available from Devteam HaywoodTech. Until a patch is released, apply the following interim mitigations: restrict administrative plugin access by limiting WooCommerce admin panel access to known IP ranges via firewall or web application firewall rules, enforce strong authentication including two-factor authentication for all WordPress administrative accounts, audit current product ordering to detect unauthorized changes, and consider temporarily disabling the plugin if it is not actively required. Monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/products-rearrange-woocommerce for patch release notifications and apply updates immediately upon availability.