What is the CVSS score of CVE-2026-61958?

CVE-2026-61958 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

License Manager for WooCommerce CVE-2026-61958

EUVD-2026-43437 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass License Manager For Woocommerce Wordpress Plugin Saad Iqbal

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-accessible WordPress plugin endpoint (AV:N); requires authenticated low-privilege account (PR:L); content deletion produces limited integrity and availability impact only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:16 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

MEDIUM 5.4

DescriptionCVE.org

Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.17.

AnalysisAI

Missing authorization in the License Manager for WooCommerce WordPress plugin (versions through 3.0.17) allows authenticated low-privilege users to perform arbitrary content deletion without proper permission checks. The flaw stems from CWE-862, where sensitive plugin actions are accessible to any authenticated user regardless of their assigned role. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.

Technical ContextAI

The affected component is the License Manager for WooCommerce WordPress plugin (CPE: cpe:2.3:a:saad_iqbal:license_manager_for_woocommerce:*:*:*:*:*:*:*:*) developed by Saad Iqbal, operating within the WooCommerce e-commerce ecosystem on WordPress. CWE-862 (Missing Authorization) describes a failure to enforce access control checks before executing privileged operations - in this case, the plugin does not verify whether the requesting authenticated user possesses sufficient capabilities before allowing content deletion. WordPress plugins commonly expose AJAX endpoints or REST API routes that should gate destructive actions behind capability checks (e.g., WordPress's current_user_can() function); absence of these checks is the root cause class here.

RemediationAI

The primary remediation is to update the License Manager for WooCommerce plugin beyond version 3.0.17 via the WordPress plugin dashboard or by downloading the latest release from the plugin repository; the exact fixed version was not independently confirmed in the available data, so verify the changelog prior to updating. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/license-manager-for-woocommerce/vulnerability/wordpress-license-manager-for-woocommerce-plugin-3-0-17-arbitrary-content-deletion-vulnerability should be consulted for the confirmed fix version once available. As a compensating control pending patching, site administrators can disable open user registration to prevent untrusted accounts from exploiting the missing authorization check, though this may impact legitimate customer onboarding workflows. Web application firewall (WAF) rules that detect and block unexpected deletion-related plugin requests from non-admin roles can provide additional layered defense with minimal trade-off.