EUVD-2026-43344Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible endpoint requiring only a valid WordPress user account (PR:L); integrity-only impact as stock location data can be manipulated but no confidentiality or availability loss applies.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <= 3.1.8.
AnalysisAI
Stock Locations for WooCommerce plugin (versions through 3.1.8) exposes one or more privileged operations without performing authorization checks, allowing authenticated low-privileged WordPress users to manipulate stock location data they should have no rights to modify. Rooted in CWE-862 (Missing Authorization), the flaw means the plugin accepts and executes sensitive requests based solely on authentication rather than verifying the requester's WordPress capability level. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low-privilege access requirement and straightforward network exploitation path make it a realistic risk for any multi-location WooCommerce store running the affected plugin.
Technical ContextAI
The affected software is the 'stock-locations-for-woocommerce' WordPress plugin by Fahad Mahmood (CPE: cpe:2.3:a:fahad_mahmood:stock_locations_for_woocommerce), which extends WooCommerce - WordPress's dominant e-commerce framework - to manage inventory across multiple physical or warehouse locations. CWE-862 (Missing Authorization) identifies the root cause as the absence of a capability or permission check before executing a privileged operation, typically a WordPress REST API endpoint or admin-ajax handler that processes stock location create, update, or delete actions. In the WordPress security model, such operations should gate on capabilities such as manage_woocommerce or edit_products, which are held by Shop Manager and Administrator roles but not by lower roles such as Subscriber or Customer. The CVSS integrity impact of High with zero confidentiality or availability impact confirms the flaw enables unauthorized data manipulation rather than information disclosure or service disruption, consistent with broken access control in an inventory management context.
RemediationAI
The primary remediation is to upgrade the Stock Locations for WooCommerce plugin to a version beyond 3.1.8 once a patched release is published by Fahad Mahmood - check the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/stock-locations-for-woocommerce/vulnerability/wordpress-stock-locations-for-woocommerce-plugin-3-1-8-broken-access-control-vulnerability for availability, as no specific fixed version is confirmed from the data available at time of analysis. As a compensating control pending a patch, administrators should audit which WordPress roles can create user accounts on the site and disable public registration if it is not operationally required - this raises the barrier for external attackers who would otherwise self-register a low-privileged account. Administrators should also review current low-privileged users (Subscriber, Customer) for any suspicious accounts and consider temporarily deactivating the plugin if multi-location stock management is not actively needed, eliminating the attack surface entirely with the trade-off of losing that inventory functionality. Restricting WordPress REST API access to authenticated sessions via firewall or plugin-level controls does not mitigate this flaw since PR:L authentication is already required for exploitation.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today