EUVD-2026-69855
GHSA-rcrg-g6hp-vjxv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible via authenticated vendor role (PR:L); no confidentiality or availability impact; integrity high due to cross-vendor data modification.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.
AnalysisAI
Insecure Direct Object Reference in the WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated user holding the vendor role to tamper with product variations owned by other vendors and to overwrite the status and title of arbitrary WordPress posts. The root cause is that the plugin never validates whether a user-supplied object ID actually belongs to the requesting vendor before persisting changes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account with the WordPress 'vendor' role on a site running WC Vendors before 2.7.2.1. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) correctly characterizes this as a medium-severity, network-accessible flaw requiring only low-privilege (vendor-role) authentication with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WC Vendors plugin to version 2.7.2.1 or later, which is confirmed by the vendor as the patched release per the WPScan advisory at https://wpscan.com/vulnerability/e573c233-ed24-40a3-a16a-c80317910cce/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wc Vendors
View allMissing order-ownership verification in WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated vendor to ma
CSRF protection is absent on front-end order shipment status actions in the WC Vendors WordPress plugin before version 2
Share
External POC / Exploit Code
Leaving vuln.today