EUVD-2026-43344Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible endpoint requiring only a valid WordPress user account (PR:L); integrity-only impact as stock location data can be manipulated but no confidentiality or availability loss applies.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <= 3.1.8.
AnalysisAI
Stock Locations for WooCommerce plugin (versions through 3.1.8) exposes one or more privileged operations without performing authorization checks, allowing authenticated low-privileged WordPress users to manipulate stock location data they should have no rights to modify. Rooted in CWE-862 (Missing Authorization), the flaw means the plugin accepts and executes sensitive requests based solely on authentication rather than verifying the requester's WordPress capability level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold any valid authenticated WordPress session on the target site - at minimum a Customer or Subscriber role account - consistent with PR:L in the CVSS vector; completely unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) scoring 6.5 Medium accurately reflects a realistic but bounded threat: the attack is network-accessible, requires no special conditions (AC:L), needs no user interaction, but is gated behind a valid WordPress user account (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or obtains a low-privileged WooCommerce Customer account on a target WordPress store, then sends an authenticated HTTP request directly to the plugin's unprotected endpoint - bypassing the authorization check that should restrict the operation to Shop Managers or Administrators - and modifies, creates, or deletes stock location records. Because the plugin does not verify the requesting user's WordPress capabilities, the server processes the operation as legitimate, potentially corrupting inventory data across all warehouse locations. … |
| Remediation | The primary remediation is to upgrade the Stock Locations for WooCommerce plugin to a version beyond 3.1.8 once a patched release is published by Fahad Mahmood - check the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/stock-locations-for-woocommerce/vulnerability/wordpress-stock-locations-for-woocommerce-plugin-3-1-8-broken-access-control-vulnerability for availability, as no specific fixed version is confirmed from the data available at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today