Fraud Prevention for WooCommerce EUVD-2026-113729

Requires the Fraud Prevention For WooCommerce and EDD plugin (version before 2.3.6) installed and active on a WordPress site alongside WooCommerce or EDD, and the attacker must hold an authenticated account of Subscriber role or above (PR:L) - the plugin fails to check order-management capability before adding customer details to the fraud blacklist. Limiting factors: exploitation is gated by needing a valid low-privilege account, so sites that disable open/self-service registration substantially raise the bar; impact is limited to blocking legitimate customers from ordering (availability/integrity of the blacklist), with no data disclosure and no code execution. No user interaction is needed (UI:N).

This is a moderate, low-urgency issue rather than a high-priority emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) describes a network-reachable, low-complexity flaw requiring low privileges (PR:L) - i.e. an authenticated account at Subscriber level or above - with no confidentiality impact and only limited integrity and availability impact. All threat-intelligence signals point the same direction and are mutually consistent: EPSS is very low (0.13%, 3rd percentile), SSVC shows Exploitation=none, Automatable=no, Technical Impact=partial, there is no CISA KEV listing, and the vuln.today decision label is 'this_month' (routine patch cadence, not act_now/emergency). No signals conflict here. The practical impact is a business-logic denial of service: an abuser can blacklist legitimate customers, degrading store availability (A:L) and data integrity of the fraud list (I:L), but cannot read data or take over the system. Net: a genuine access-control defect worth patching in normal cycles, but not a drop-everything issue, especially on sites that do not allow open/self-service account registration.

On a WooCommerce or EDD store running the plugin before 2.3.6, an attacker registers or obtains a low-privilege account (Subscriber or above). Because the plugin does not verify order-management capability, the attacker invokes the add-to-blacklist action with a target customer's details, causing that legitimate customer to be blocked from placing orders. No public exploit identified at time of analysis; exploitation would require a working authenticated request against the vulnerable action.