EU VAT Assistant for WooCommerce EUVD-2026-103232

Exploitation requires the EU VAT Assistant for WooCommerce plugin (version ≤ 2.1.30.260413) active on a WooCommerce store, with the attacker able to submit a value into the 'vat_number' field during order placement/checkout - no authentication is needed (PR:N). The payload is stored and does not fire immediately; it executes only when an administrator (or other user) subsequently opens the affected order via WooCommerce → Orders → Edit Order, so the practical limiting factor is that a privileged user must view the poisoned order page. No non-default configuration is indicated; the risk applies to default deployments that accept VAT numbers from customers.

This is a genuine, actionable priority despite not being the highest-severity class of bug. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes a network-reachable, low-complexity, unauthenticated stored XSS with a scope change (S:C) - the hallmark of a client-side flaw whose payload crosses from the attacker's input into a privileged administrator browser context. The real severity driver is the escalation path stated in the description: the stored payload runs in an administrator's session when an order is reviewed, enabling rogue admin account creation and full site takeover, which effectively pushes the practical integrity impact well above the 'Low' the base vector records. No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence, and the vulnerability is reported by Wordfence (a credible WordPress-focused source) rather than confirmed exploited. Signals are therefore consistent rather than conflicting: a solid unauthenticated-injection CVSS with no evidence of active exploitation. One caveat to verify: the base vector is scored UI:N, yet exploitation realistically depends on an administrator opening the injected order page - a passive, near-certain action in normal store operation, but technically a dependency defenders should note. Treat this as a prompt-patch item for any site running the plugin, weighted by whether orders from untrusted customers are routinely reviewed in wp-admin.

An unauthenticated attacker places or submits a WooCommerce order and enters a malicious script into the 'vat_number' field, which is stored without proper sanitization or output escaping. When a store administrator later opens that order via WooCommerce → Orders → Edit Order, the payload executes in their authenticated browser session and can silently create a rogue administrator account, leading to full site takeover. No public exploit code was identified at time of analysis, but the injection point and sink are documented in the referenced plugin source lines.