WooCommerce Stock Locations CVE-2026-57419

Exploitation requires the attacker to hold any valid authenticated WordPress session on the target site - at minimum a Customer or Subscriber role account - consistent with PR:L in the CVSS vector; completely unauthenticated exploitation is not possible. The Stock Locations for WooCommerce plugin version 3.1.8 or earlier must be installed and active alongside WooCommerce on the WordPress installation. No non-default configuration is required to be vulnerable: the missing authorization check is present in the plugin's default request handling for stock location operations, and the flaw is exploitable on any standard plugin deployment. Exploitation is most accessible on sites with open user registration enabled, which allows an external attacker to self-register a Customer account. Sites with closed registration or invite-only account creation limit exploitation to internal users and already-compromised low-privileged accounts, meaningfully reducing external attack surface despite the flaw remaining present.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) scoring 6.5 Medium accurately reflects a realistic but bounded threat: the attack is network-accessible, requires no special conditions (AC:L), needs no user interaction, but is gated behind a valid WordPress user account (PR:L). This means unauthenticated external attackers cannot exploit the flaw directly; exploitation requires either a pre-existing account on the target WordPress installation or successful credential acquisition. The Patchstack tag 'Authentication Bypass' is slightly misleading - the CVSS PR:L metric confirms authentication is still required; the bypass is of authorization (role/capability checks), not authentication itself. No EPSS score was provided, KEV status is absent, and no public proof-of-concept exploit has been identified, leaving exploitation probability speculative. The integrity impact is High, meaning successful exploitation could corrupt stock location assignments and disrupt order fulfillment or falsify inventory data - a meaningful business impact for e-commerce operations. Overall, this is a genuine medium-severity risk for affected WooCommerce sites, elevated for stores that allow open user registration, but not an emergency-tier issue given the authentication prerequisite.

An attacker registers or obtains a low-privileged WooCommerce Customer account on a target WordPress store, then sends an authenticated HTTP request directly to the plugin's unprotected endpoint - bypassing the authorization check that should restrict the operation to Shop Managers or Administrators - and modifies, creates, or deletes stock location records. Because the plugin does not verify the requesting user's WordPress capabilities, the server processes the operation as legitimate, potentially corrupting inventory data across all warehouse locations. No public proof-of-concept exploit has been identified at time of analysis, but the straightforward nature of missing authorization flaws makes manual exploitation feasible without specialized tooling.