Smart Manager EUVD-2026-31767

Exploitation requires (1) the target WordPress site to have the StoreApps Smart Manager plugin installed and active at version 8.85.0 or earlier, and (2) the attacker to hold a valid authenticated session at some non-zero privilege level (CVSS PR:L) - most realistically a self-registered subscriber or customer account on a WooCommerce store that permits open registration, or a compromised low-privilege staff account such as shop_manager/editor. No user interaction by a victim is required (UI:N), the attack is fully remote over HTTP(S) (AV:N), and exploitation is low-complexity (AC:L) with unchanged scope (S:U). Limiting factors are the PR:L authentication barrier (sites that disable user registration and have no other low-privilege accounts are not exposed to anonymous internet attackers), the need for the vulnerable plugin to actually be installed (it is a paid third-party WooCommerce add-on, not bundled with WordPress), and SSVC's assessment that the issue is not Automatable, suggesting per-target exploitation effort rather than mass scanning.

The signals are mixed and point to high theoretical impact but low immediate exploitation pressure. CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity attack requiring some authentication (PR:L) with no user interaction and total CIA impact - consistent with an authenticated WordPress user abusing a plugin endpoint to gain admin. EPSS is only 0.04% (12th percentile) and CISA SSVC reports Exploitation: none, Automatable: no, Technical Impact: total, meaning while a successful exploit fully compromises the site, no widespread exploitation is observed and the attack does not appear easily automatable across targets. The vulnerability is not in CISA KEV, no PoC is referenced, and Patchstack is the sole reporter - so this is genuinely high-impact but currently low-likelihood, warranting prompt patching especially on multi-user stores (customer/subscriber registration enabled) where the PR:L barrier is trivial to satisfy.

A site permits customer or subscriber self-registration (common on WooCommerce stores); an attacker registers a low-privilege account, then sends a crafted authenticated request to a Smart Manager endpoint that updates user records or capabilities, promoting their own account to administrator. With admin rights, the attacker installs a malicious plugin or modifies theme files to achieve full site takeover and persistent backdoor access. No public exploit is identified at time of analysis, so this scenario is derived from the CWE-266 root cause and CVSS vector rather than a published PoC.