License Manager for WooCommerce CVE-2026-56013

No authentication is required - the CVSS vector explicitly sets PR:N and the vulnerability is tagged as an authentication bypass, confirming unauthenticated exploitation. The plugin must be installed and active within a WordPress site running WooCommerce, at version 3.0.15 or earlier. No non-default configuration is required; the flaw is present in standard plugin operation. The attack is limited to the integrity and availability of license objects (C:N per CVSS) - under the reported impact model, an attacker can manipulate or disrupt license records but cannot read license key material. Exploitation requires network reachability to the WooCommerce storefront, which is the normal internet-facing deployment posture. Limiting factors include: the plugin must be actively installed and enabled; the target store must be network-accessible; and the absence of confidentiality impact means the flaw cannot be used for passive data harvesting of license keys under the current impact assessment.

The NVD CVSS 3.1 base score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L reflects a low-complexity, unauthenticated, network-accessible attack with limited but real impact. Notably, the confidentiality dimension scores N, which is atypical for IDOR vulnerabilities - this suggests the flaw enables manipulation or disruption of license records rather than disclosure of license key material; this metric warrants independent verification with the vendor, as it may understate true impact. No EPSS score was provided in the intelligence feed, and the vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis. However, the combination of PR:N and AC:L substantially lowers the exploitation bar: any actor with network access to the store can attempt exploitation without any credential or special tooling. The real-world priority is moderate for WooCommerce operators relying on this plugin for license enforcement - disruption of license records could invalidate legitimate customer activations, constituting meaningful availability and integrity harm to the business. The absence of a public exploit and KEV listing keeps this below critical operational urgency, but the unauthenticated attack surface means it should not be deferred indefinitely.

An unauthenticated attacker sends a series of HTTP requests to the License Manager for WooCommerce plugin's public endpoints, substituting sequential or guessed license object identifiers in request parameters. The plugin performs no authorization check on the supplied identifier, allowing the attacker to reference and modify or invalidate license records belonging to other customers. This could be used to disrupt a competitor's customer activations or to selectively invalidate license keys for targeted accounts, with no credentials or prior access required.