Product Slider WooCommerce EUVD-2026-48221

Exploitation requires an authenticated session with at minimum WordPress contributor-level privileges (confirmed by CVSS PR:L). The target site must have the Product Slider for WooCommerce plugin installed and active at version 1.13.62 or earlier. The specific plugin endpoint or AJAX action handling the IDOR-vulnerable request is not named in available intelligence - the exact parameter or endpoint must be confirmed from the full Patchstack advisory. Exploitation is limited to confidentiality disclosure only (no write or denial-of-service capability per CVSS I:N/A:N). Sites that disable open user registration or restrict contributor account creation to vetted users significantly reduce practical exploitability, as the attacker must already hold a valid low-privilege account.

The reported CVSS base score of 4.3 (Medium) is consistent with the vector: network reachable (AV:N), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and only confidentiality impact at low severity (C:L/I:N/A:N). The PR:L requirement is a meaningful real-world constraint - exploitation is gated on possessing a valid WordPress contributor account on the target site, which limits opportunistic mass exploitation. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing confirms this is not currently tracked as actively exploited. No public proof-of-concept code was identified. The tag 'Authentication Bypass' may be a reporting taxonomy label rather than a true authentication bypass, as the CVSS PR:L metric explicitly requires authenticated access; this label conflict should be verified against the full Patchstack advisory. Overall, real-world risk is moderate for multi-author WordPress/WooCommerce stores where contributor accounts are distributed broadly, and low for sites with tightly controlled user registration.

An attacker who holds or registers a contributor account on a target WooCommerce site crafts HTTP requests to a plugin endpoint, substituting arbitrary object identifiers (such as product IDs or slider configuration IDs) in place of their own authorized objects. By iterating over numeric IDs, the attacker enumerates product data, draft content, or slider configurations that are not publicly visible, potentially revealing unpublished pricing, inventory details, or content staged for future release. No public exploit code is confirmed, but the attack requires only standard HTTP manipulation with a valid session cookie.