What is the CVSS score of CVE-2026-56010?

CVE-2026-56010 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WordPress are affected by CVE-2026-56010?

Abandoned Cart Pro for WooCommerce (≤v10.4.0) enables privilege escalation for any registered user to administrator access, threatening complete compromise of e-commerce WordPress sites and exposure…

How to fix or mitigate CVE-2026-56010?

Within 24 hours: Disable Abandoned Cart Pro plugin on all WordPress installations; suspend public user registrations or restrict to pre-approved users only. Within 7 days: Conduct full audit of WordPress user accounts and administrative role assignments; review activity logs for unauthorized escalations; document plugin versions currently deployed. Within 30 days: Apply vendor-released patch when available; if no patch timeline announced, migrate to alternative cart recovery plugin; implement role-based access controls limiting administrative privileges.

WordPress CVE-2026-56010

EUVD-2026-39686 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-06-26 audit@patchstack.com

GHSA-5542-h87w-j2j2

WordPress Privilege Escalation

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (patchstack) · only source for this CVE.

CVSS VectorVendor: patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:39 vuln.today

CVE Published

Jun 26, 2026 - 15:16 cve.org

HIGH 8.8

DescriptionCVE.org

Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.

Articles & Coverage 1

News 11 New WordPress Vulnerabilities - 1 Critical, 10 High, 2 With POC Jun 27, 2026

AnalysisAI

Privilege escalation in the Abandoned Cart Pro for WooCommerce plugin (versions <= 10.4.0) allows an authenticated low-privileged user (Subscriber) to elevate their own permissions and gain higher-privileged capabilities within the WordPress site. The flaw, reported by Patchstack and classified as CWE-266 (Incorrect Privilege Assignment), carries a CVSS 8.8 and is network-exploitable with low complexity once an attacker holds any minimal account. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Disable Abandoned Cart Pro plugin on all WordPress installations; suspend public user registrations or restrict to pre-approved users only. …

Threat intelligence, references, and detailed analysis are available after sign-in.