License Manager for WooCommerce EUVD-2026-43437

Exploitation requires an authenticated WordPress session with at minimum a low-privilege role such as subscriber or customer (confirmed by CVSS PR:L). The target site must be running License Manager for WooCommerce version 3.0.17 or earlier. No special server-side configuration is required beyond having the vulnerable plugin installed and active. Exploitation is limited by the need for a valid authenticated account - unauthenticated external attackers cannot exploit this vulnerability directly. Sites with open user registration (allowing anyone to self-register) are at meaningfully higher risk, as the authentication barrier is trivially bypassed in those environments.

The CVSS 3.1 score of 5.4 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring a low-privilege authenticated account (PR:L) with no user interaction (UI:N). The impact is limited to integrity and availability at the low level (I:L, A:L) with no confidentiality impact. No EPSS score was provided in the intelligence, making exploitation probability estimation uncertain. The vulnerability is not listed in CISA KEV and no POC code has been disclosed, which meaningfully reduces near-term real-world risk. The PR:L requirement is a notable limiting factor - attackers must hold at least a subscriber or customer account on the target WordPress site, narrowing the attacker pool to authenticated users. The arbitrary content deletion impact is operationally disruptive but not catastrophic in isolation. Overall, this is a real but moderate-priority issue, warranting prompt patching for sites with open user registration or untrusted user bases.

An attacker registers or obtains a low-privilege WordPress account (e.g., subscriber or customer) on a target site running License Manager for WooCommerce ≤3.0.17. The attacker then sends crafted HTTP requests to the plugin's unprotected endpoint, invoking deletion operations against arbitrary content without triggering any authorization failure. No public exploit code has been identified, meaning this scenario currently requires manual exploitation knowledge derived from the plugin's source code.