What is the CVSS score of CVE-2026-61952?

CVE-2026-61952 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

WP Sheet Editor CVE-2026-61952

EUVD-2026-43433 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Woocommerce Bulk Edit Products Wp Sheet Editor

4.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

4.9 MEDIUM

High-privilege authentication required to reach the bulk-edit handler; only integrity impacted via unauthorized product data modification, no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:17 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

MEDIUM 4.9

DescriptionCVE.org

Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products - WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products - WP Sheet Editor: from n/a through <= 1.8.21.

AnalysisAI

Missing authorization in WooCommerce Bulk Edit Products - WP Sheet Editor (versions up to and including 1.8.21) permits authenticated high-privilege users to exploit incorrectly configured access control security levels, resulting in unauthorized bulk modification of WooCommerce product data. The vulnerability stems from CWE-862 (Missing Authorization), where the plugin fails to enforce proper capability checks before executing privileged bulk-edit operations via the network. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis, though the integrity-only impact and high-privilege requirement constrain the realistic attack surface.

Technical ContextAI

The affected component is the 'WooCommerce Bulk Edit Products - WP Sheet Editor' WordPress plugin authored by Jose Vega, identified by CPE cpe:2.3:a:jose_vega:woocommerce_bulk_edit_products_-_wp_sheet_editor:*:*:*:*:*:*:*:*. The plugin extends WooCommerce - the dominant WordPress e-commerce framework - by providing spreadsheet-style bulk editing of product records. CWE-862 (Missing Authorization) indicates that sensitive actions (bulk product edits) are reachable via the network without the plugin verifying that the requesting user possesses the necessary WordPress capability (e.g., 'manage_woocommerce' or 'edit_products'). This class of flaw is extremely common in WordPress plugins where REST API endpoints or AJAX handlers register callbacks without a corresponding 'current_user_can()' or nonce-plus-capability check, allowing role escalation within the authenticated session context.

RemediationAI

No exact patched version number is confirmed in the available intelligence data - the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woo-bulk-edit-products/vulnerability/wordpress-woocommerce-bulk-edit-products-wp-sheet-editor-plugin-1-8-21-broken-access-control-vulnerability should be consulted for the confirmed fix release. Site administrators should update the plugin to the latest version available in the WordPress plugin repository and verify the changelog indicates a fix for this authorization issue. As a compensating control pending patching, restrict WordPress administrative access to the minimum necessary set of trusted accounts and enforce strong credentials and multi-factor authentication for all roles at or above Shop Manager level, since exploitation is gated on high-privilege account access. Additionally, consider temporarily disabling the plugin if bulk-edit functionality is not actively needed, accepting the trade-off of lost bulk-editing capability. Monitor product catalog data (pricing, stock, descriptions) for unexpected changes as a detection measure.