What is the CVSS score of CVE-2026-56013?

CVE-2026-56013 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

License Manager for WooCommerce CVE-2026-56013

EUVD-2026-39376 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-25 Patchstack

GHSA-mfcp-5rpw-xxc5

WordPress Authentication Bypass Mycred License Manager For Woocommerce Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-accessible unauthenticated IDOR on standard WooCommerce plugin endpoints; manipulation-only impact supports I:L/A:L with C:N pending vendor confirmation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:37 vuln.today

CVE Published

Jun 25, 2026 - 13:12 cve.org

MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.

AnalysisAI

Unauthenticated IDOR in License Manager for WooCommerce (versions <= 3.0.15) allows remote, unauthenticated attackers to reference and manipulate arbitrary license records by supplying or iterating object identifiers in plugin requests, yielding integrity and availability impacts on license data. The CVSS vector (PR:N, AV:N, AC:L) confirms no authentication or special conditions are needed, making the attack trivially repeatable against any reachable WooCommerce store running the affected plugin. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

License Manager for WooCommerce (vendor: mycred; CPE cpe:2.3:a:mycred:license_manager_for_woocommerce:*:*:*:*:*:*:*:*) is a WordPress plugin that generates, distributes, and validates software license keys within WooCommerce storefronts. CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the application uses a caller-supplied identifier - such as a license key ID, order reference, or activation token - to locate and act upon a backend object without verifying that the requesting party is authorized to operate on that specific record. Because these identifiers are often sequential or predictable, an unauthenticated attacker can enumerate valid object references and perform operations (modification, invalidation) on records belonging to other customers. The flaw resides in the plugin's public-facing request handling layer, which is accessible without authentication in a standard WooCommerce deployment.

RemediationAI

Update License Manager for WooCommerce to a version above 3.0.15 as soon as a patched release is available from the plugin author (mycred). No confirmed patched version number is present in the provided intelligence data; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/license-manager-for-woocommerce/vulnerability/wordpress-license-manager-for-woocommerce-plugin-3-0-15-insecure-direct-object-references-idor-vulnerability should be monitored for the confirmed fix version. As an interim compensating control while awaiting a patch, consider deploying a web application firewall rule to block or rate-limit unauthenticated requests to the plugin's license management REST or admin-ajax endpoints - note that overly broad blocking rules may disrupt legitimate customer license activation flows, so rules should be scoped to anomalous enumeration patterns rather than all plugin traffic. Disabling the plugin entirely eliminates the attack surface but also removes license management functionality. No upstream patch commit or tagged release was independently confirmable from the available references.