WooCommerce EU VAT EUVD-2026-103277

Exploitation requires the attacker to control the CF-IPCountry HTTP request header during a WooCommerce guest checkout; the plugin writes this header value unsanitized into order post-meta and later renders it without output escaping. The primary limiting factor is header controllability: CF-IPCountry is normally set by Cloudflare, so an attacker can only plant an arbitrary value when the store is NOT behind Cloudflare (or where Cloudflare does not strip a client-supplied CF-IPCountry header). Additional prerequisites: guest checkout must be permitted (WooCommerce default) and a privileged user (store admin/staff) must subsequently view the injected order in wp-admin for the stored script to execute. No account or authentication is required to plant the payload.

This is a genuine but conditional risk rather than an emergency. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) indicates a remotely reachable, low-complexity, unauthenticated stored XSS whose scope-change (S:C) reflects payload execution in the context of whoever later views the order - typically a store administrator in wp-admin. No EPSS score, KEV entry, or public POC was provided in the intelligence set, so exploitation signals are weak: no public exploit identified at time of analysis and no evidence of active exploitation. The practical limiter is the injection vector itself - the CF-IPCountry HTTP header is normally populated by Cloudflare, so an attacker can only plant an arbitrary value where the store is NOT fronted by Cloudflare (or where a client-supplied CF-IPCountry header is not stripped/overwritten), which tempers the AC:L rating in real deployments. One signal tension to flag: the vector asserts UI:N, but exploitation realistically requires a privileged user (admin/staff) to open the injected order for the script to fire - verify whether victim interaction should raise effective user-interaction expectations. Overall: a legitimate stored-XSS admin-takeover vector worth patching promptly for exposed stores, but absent EPSS/KEV/POC it is not evidence of mass exploitation.

An attacker performs a guest checkout on a vulnerable WooCommerce store while sending a crafted CF-IPCountry request header containing a JavaScript payload, which the plugin persists verbatim into the order's post-meta. When a store administrator later opens that order in the WordPress admin, the stored script executes in their authenticated session, enabling session/cookie theft or admin actions. No public exploit code was identified at time of analysis, and the header can typically only be spoofed when the store is not behind Cloudflare.