WooCommerce Auction Pro CVE-2026-4110

The target WordPress site must have the ultimate-woocommerce-auction-pro plugin installed and activated at version 2.4.5 or earlier. The attacker requires no authentication (PR:N) and no access to the server - only the ability to deliver a crafted URL to a victim. Exploitation is strictly bounded by user interaction: the attack cannot succeed without a high-privilege user (admin or equivalent) actively clicking the malicious link in an authenticated browser session (UI:R). Non-default conditions that limit exploitation: the victim must have an active, authenticated session when clicking the link; SSVC Automatable:No confirms that batch or scripted mass exploitation against arbitrary users is not feasible. The attack does not require any specific plugin configuration beyond the plugin being active.

The CVSS 6.1 Medium score is consistent with reflected XSS targeting privileged users: network-accessible (AV:N), low complexity (AC:L), no attacker authentication required (PR:N), but mandatory victim interaction (UI:R) significantly limits mass exploitation. EPSS at 0.15% (5th percentile) signals low probability of widespread automated exploitation, consistent with the SSVC finding of Automatable:No - automated mass delivery is infeasible without social engineering each target individually. SSVC Technical Impact:Partial reflects that exploitation grants script execution within the admin's session rather than full server compromise. The combination of a public POC (per WPScan), PR:N, and S:C elevates targeted risk above the raw CVSS score suggests for sites where administrators are reachable via phishing. The vulnerability is not in CISA KEV. No conflict between signals: all sources align on targeted, social-engineering-dependent exploitation with moderate impact ceiling.

An attacker enumerates a target WordPress site using the vulnerable plugin version via passive fingerprinting, then crafts a URL embedding a JavaScript payload into the unsanitized parameter - a public POC from WPScan provides the exact payload structure. The attacker sends this URL to a site administrator via a phishing email or forum post disguised as a legitimate plugin notification, and when the admin clicks the link in their authenticated browser session, the injected script executes, exfiltrating the session cookie or silently creating a new administrator account under the attacker's control.