EUVD-2026-88100
GHSA-gg4x-5759-6rq2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attacker must hold the blocked account (PR:L) and reach an unenforced login path (AV:N/AC:L); impact is limited to that account's existing customer-level access, so C:L/I:L/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.
AnalysisAI
Blocked accounts can keep authenticating on the authentication paths that the Blacklist Manager for WooCommerce WordPress plugin (versions 1.3.0 through 2.3.1) fails to hook, so a user whom the site owner has explicitly blocked retains the privileges of their original role - typically a customer-level WordPress/WooCommerce account - with the block neither enforced nor recorded. Exploitation requires the attacker to already hold valid credentials for a blocked account (CVSS 3.1 score 5.4, AV:N/AC:L/PR:L/UI:N, authenticated), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) is indicated at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the attacker already hold a WordPress/WooCommerce account on the target site AND that the site owner has explicitly blocked that account using the Blacklist Manager for WooCommerce plugin (versions 1.3.0 through 2.3.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a broken-access-control / authentication-enforcement flaw in the Blacklist Manager for WooCommerce plugin (1.3.0-2.3.1): a user account the site owner has explicitly blocked can continue to authenticate on paths where the plugin fails to enforce its block. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified in the available intelligence at time of analysis, so the immediate priority is to neutralize the affected accounts rather than rely on the plugin's block: reset the password of every blocked user to a random value and strip its role (or reassign to a no-capability role), which definitively closes all authentication paths at the cost of losing the audit trail that the block was meant to preserve; deleting the account entirely is stronger but breaks attribution of past orders and subscriptions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today