What is the CVSS score of CVE-2026-49072?

CVE-2026-49072 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

WooCommerce Anti-Fraud CVE-2026-49072

EUVD-2026-37615 MEDIUM

Missing Authorization (CWE-862)

2026-06-17 Patchstack

WordPress Authentication Bypass Wordpress Plugin Woocommerce Anti Fraud Opmc

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable, unauthenticated endpoint with no user interaction; scope unchanged; limited integrity and availability impact only, no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:51 vuln.today

CVE Published

Jun 17, 2026 - 09:51 cve.org

MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.

AnalysisAI

Unauthenticated broken access control in the WooCommerce Anti-Fraud WordPress plugin by OPMC (versions ≤ 7.2.6) allows remote unauthenticated attackers to perform unauthorized actions against the anti-fraud layer of WooCommerce stores. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, and CWE-862 (Missing Authorization) identifies the root cause as absent capability or permission checks on one or more plugin endpoints. With integrity (I:L) and availability (A:L) impacts, attackers could potentially interfere with or circumvent fraud detection logic, enabling fraudulent orders to pass undetected or disrupting store operations. No public exploit code has been identified and CISA KEV listing is absent at time of analysis.

Technical ContextAI

CWE-862 (Missing Authorization) describes a failure to verify that an actor is permitted to perform a requested operation before executing it. In the WordPress plugin ecosystem this typically surfaces as AJAX handlers registered via wp_ajax_nopriv_ hooks, REST API routes lacking permission_callback enforcement, or admin-facing endpoints that omit current_user_can() checks. The WooCommerce Anti-Fraud plugin (CPE: cpe:2.3:a:opmc:woocommerce_anti-fraud:*:*:*:*:*:*:*:*) by OPMC is designed to score and flag potentially fraudulent WooCommerce orders. Missing authorization in this context is particularly impactful because the affected functionality likely governs fraud rule management, order status override, or plugin configuration - controls whose bypass directly undermines store fraud defenses. The vulnerability is classified under the broader Authentication Bypass tag by Patchstack, suggesting the missing check allows anonymous visitors to invoke functionality intended only for administrators or shop managers.

RemediationAI

The primary recommended action is to update the WooCommerce Anti-Fraud plugin to a version beyond 7.2.6 once a patched release is published by OPMC; administrators should monitor the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-anti-fraud/vulnerability/wordpress-woocommerce-anti-fraud-plugin-7-2-6-broken-access-control-vulnerability for patch availability. No exact fix version is confirmed in the available data, so a vendor-released patch cannot be cited. As an interim compensating control, site administrators should consider temporarily deactivating the plugin if fraud detection is not critically time-sensitive, accepting the trade-off of losing automated fraud scoring until a patch is applied. Alternatively, deploying a web application firewall (WAF) rule to restrict access to the plugin's AJAX or REST endpoints to authenticated sessions only can reduce unauthenticated exposure, though this may impair legitimate plugin functionality and requires testing. Access to the WordPress admin area should be restricted by IP where operationally feasible. Patchstack's virtual patching feature (if subscribed) may provide a rule-based mitigation without code changes.