Ultimate WooCommerce Auction Pro CVE-2026-4259

Exploitation requires that a high-privilege user (typically a WordPress administrator) be authenticated and be socially engineered into clicking or loading an attacker-crafted URL containing the malicious payload in the vulnerable, unsanitized request parameter - this mandatory user interaction (UI:R) is the primary limiting factor. The attacker themselves needs no account or privileges (PR:N) and no special server configuration; the flaw is present in default installations of Ultimate WooCommerce Auction Pro through 2.4.5. Realistic risk is bounded by the fact that the payload is reflected (not stored), so each victim must be individually lured, and the highest value comes only when the victim holds administrative privileges.

The signals are largely consistent and point to a moderate, not urgent, priority. CVSS 3.1 is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable and low-complexity with no attacker privileges required, but exploitation is gated on user interaction (UI:R) - a targeted admin must click the attacker's link. The scope change (S:C) and low CIA impacts reflect that script executes in the victim's browser context rather than granting direct server compromise. Corroborating the lower urgency, EPSS is only 0.15% (4th percentile) and CISA SSVC scores Exploitation: none, Automatable: no, Technical Impact: partial. The one aggravating factor is that public exploit code exists (WPScan) and the intended target is high-privilege admins, so successful exploitation could be leveraged toward account or site takeover via CSRF-style actions or session abuse. Not in CISA KEV. Net: a real but socially-engineered, non-wormable issue - patch on a normal cycle, prioritize if administrators are exposed to untrusted links.

An attacker crafts a URL to a vulnerable plugin endpoint embedding a malicious script in the reflected parameter and delivers it to a site administrator via email, comment, or chat. When the logged-in admin opens the link, their browser executes the attacker's JavaScript in the wp-admin context, allowing actions such as stealing session data, creating a rogue admin account, or performing authenticated requests on the admin's behalf. Publicly available exploit code (WPScan) lowers the barrier to weaponizing the payload.