What is the CVSS score of CVE-2026-56050?

CVE-2026-56050 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

PPOM for WooCommerce CVE-2026-56050

EUVD-2026-39398 MEDIUM

Improper Access Control (CWE-284)

2026-06-25 Patchstack

GHSA-qp5v-h8qw-wpmh

WordPress Authentication Bypass Wordpress Plugin Ppom For Woocommerce Themeisle

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Unauthenticated network-accessible endpoint with no complexity; scope unchanged; only limited integrity and availability impact confirmed, no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:38 vuln.today

CVE Published

Jun 25, 2026 - 13:34 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects PPOM for WooCommerce: from n/a through 33.0.18.

AnalysisAI

Improper access control in PPOM for WooCommerce (all versions through 33.0.18) enables unauthenticated remote attackers to bypass access controls and perform unauthorized operations affecting the integrity and availability of affected WooCommerce stores. Classified under CWE-284 and confirmed as an authentication bypass by Patchstack, the flaw exposes plugin-managed product option data to manipulation or disruption without requiring any credentials. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to CISA KEV.

Technical ContextAI

PPOM for WooCommerce is a Themeisle plugin that extends WooCommerce product pages with per-product customization options such as custom fields and add-ons. The root cause is CWE-284 (Improper Access Control), specifically falling under the 'Exploiting Incorrectly Configured Access Control Security Levels' pattern. WordPress plugins commonly register AJAX handlers or REST API endpoints; broken access control arises when WordPress capability checks (e.g., current_user_can()) are absent, misapplied, or checked at the wrong hook priority, allowing unauthenticated callers to reach privileged functionality. The full affected scope is expressed by CPE cpe:2.3:a:themeisle:ppom_for_woocommerce covering all versions through 33.0.18.

RemediationAI

The primary remediation is to update PPOM for WooCommerce to the version released after 33.0.18; the exact patched version number is not independently confirmed in the available intelligence, so the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-product-addon/vulnerability/wordpress-ppom-for-woocommerce-plugin-33-0-18-broken-access-control-vulnerability should be consulted directly for the confirmed fix version. If an immediate update is not feasible, restrict access to the WordPress admin panel and WooCommerce AJAX or REST API endpoints at the WAF or web server layer to trusted IP ranges - note this will degrade legitimate customer-facing product option functionality. As a last resort, deactivating the PPOM plugin eliminates the attack surface at the cost of losing product add-on functionality until a patch is applied.