SKU Error Fixer CVE-2026-86850

Requires the SKU Error Fixer for WooCommerce plugin (version through 1.0) installed and active on a WooCommerce store; the two vulnerable AJAX actions are registered for unauthenticated (nopriv) users and perform no capability or nonce checks, so no login or user interaction is needed. Exploitation is scoped and limited: the attacker can only disclose or delete product variations the plugin itself classifies as 'obsolete', not arbitrary products or site data, which is why Attack Complexity is High rather than Low. The practical impact ceiling is permanent, non-recoverable loss of those specific variations plus disclosure of their details.

Signals point to a genuine but low-priority issue. The CVSS 3.1 base score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) reflects a network-reachable, unauthenticated flaw whose weight comes mainly from the I:H component (permanent, unrecoverable deletion), tempered by AC:H because the attacker only affects variations the plugin itself classifies as 'obsolete' rather than arbitrary data. Exploitation-probability signals are low and mutually consistent: EPSS is 0.14% (3rd percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. Publicly available exploit code exists (WPScan), which raises opportunistic risk but must not be conflated with active exploitation - PoC availability and in-the-wild use are distinct signals here. No SSVC decision data was provided in the input. The dominant risk-limiting factor is deployment footprint: this is an obscure WordPress/WooCommerce plugin at version 1.0, so even a trivially reachable unauthenticated bug has a very small real-world blast radius. Net: real and worth patching for anyone running the plugin, but not a broad emergency.

An unauthenticated attacker finds a WooCommerce store running the SKU Error Fixer plugin (through 1.0) and sends a crafted AJAX request to one of its two unprotected actions. Because no capability or nonce checks are enforced, the request either discloses the details of product variations flagged as obsolete or permanently deletes them with no recoverable copy. Public exploit code for this flaw is available via WPScan, lowering the barrier to opportunistic abuse.