EUVD-2026-70597
GHSA-68qp-xj2p-87vv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running vulnerable plugin
-
DeliveryCraft spoofed authentication token or nonce
-
ExploitSend unauthenticated HTTP request to pre-order endpoint
-
ExecutionPlugin accepts spoofed credential as valid
-
ImpactRead or modify pre-order records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target WordPress site must have the Pre-Orders for WooCommerce plugin (by brightvesseldev) installed, activated, and running version 2.3 or earlier. WooCommerce must also be active, as this plugin is a WooCommerce extension. No special configuration beyond a standard plugin installation is required - the bypass applies to default plugin behavior. CVSS PR:N/AC:L/UI:N confirms exploitation requires no authentication, no complex setup, and no victim interaction. Exploitation is limited to the pre-order plugin's data scope (C:L/I:L); it does not directly grant WordPress admin access or affect unrelated site functionality. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N scores 6.5 (Medium), reflecting broad network reachability with no authentication or user interaction required, but bounded impact. The S:U (unchanged scope) and C:L/I:L metrics indicate the blast radius is confined to pre-order plugin data - an attacker cannot leverage this to fully compromise the WordPress installation or host OS directly. There is no CISA KEV listing and no POC is referenced in available data, so real-world exploitation pressure is currently low. EPSS data is not provided; given the niche plugin footprint and medium CVSS, opportunistic mass scanning is plausible but not confirmed. The primary real-world concern is unauthorized access to or manipulation of customer pre-order records on affected WooCommerce stores, which has business and privacy implications disproportionate to the raw CVSS score for affected merchants. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request to a WooCommerce store running the vulnerable plugin, including a spoofed token, nonce, or session parameter that the plugin incorrectly accepts as proof of authentication. The bypass succeeds and the attacker reads or modifies pre-order records - such as enumerating pending orders or altering order status - without ever logging in. No public exploit code is referenced, but the low attack complexity (AC:L) makes independent rediscovery straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Unauthenticated authentication bypass in the Pre-Orders for WooCommerce WordPress plugin (versions <=2.3) allows remote attackers to spoof identity or session context and gain limited read and write access to pre-order functionality without credentials. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables network-accessible exploitation with no user interaction required, resulting in partial confidentiality and integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
RemediationAI
Update the Pre-Orders for WooCommerce plugin to the version released after 2.3 via the WordPress plugin dashboard or by downloading the latest release from the WordPress plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/pre-orders-for-woocommerce/vulnerability/wordpress-pre-orders-for-woocommerce-plugin-2-3-bypass-vulnerability-vulnerability should be consulted for the confirmed patched version, which is not explicitly stated in the available input data. As a compensating control pending upgrade, site administrators can temporarily disable the plugin if pre-order functionality is not business-critical, or restrict access to the WordPress store's checkout and pre-order endpoints at the WAF or web server layer to known IP ranges. Disabling the plugin will remove pre-order functionality entirely; IP allowlisting may block legitimate customers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is the Pre-Orders for WooCommerce WordPress plugin developed by brightvesseldev (CPE: cpe:2.3:a:brightvesseldev:pre-orders_for_woocommerce:*:*:*:*:*:*:*:*), a WooCommerce extension enabling e-commerce stores to accept customer orders before product availability. CWE-290 (Authentication Bypass by Spoofing) indicates the root cause is the plugin accepting spoofed identity or authorization signals - such as manipulated cookies, tokens, nonces, or HTTP headers - as valid authentication proof, allowing unauthenticated requests to be treated as authenticated. WooCommerce plugins frequently gate pre-order management actions (creating, reading, or modifying pre-order records) behind WordPress capability checks; a bypass here skips that enforcement layer.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network-accessible spoof bypass with limited read/write impact on plugin data only; no availability impact and scope unchanged.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB