EUVD-2026-72651
GHSA-p55m-mp38-r6cw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify publicly accessible WooCommerce site below 11.1.0
-
DeliverySend high-volume crafted HTTP requests to unthrottled endpoint
-
ExploitTrigger unbounded server resource allocation
-
ExecutionExhaust PHP/database/web-worker pool
-
ImpactDeny service to all legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network access to a WooCommerce installation below version 11.1.0 - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against default configurations of WooCommerce. No specific plugin setting, optional feature, or non-default configuration is referenced in available disclosure data as a prerequisite. Limiting factors are: (1) the impact is availability-only (no data theft), reducing attacker motivation for sophisticated targeting; (2) network-level rate limiting at the CDN or load balancer layer can mitigate attack volume even on unpatched instances; (3) the specific vulnerable endpoint is not publicly disclosed by Patchstack, which may slow mass exploitation slightly. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects a low-complexity, unauthenticated, network-reachable DoS with no data exposure or integrity impact. For e-commerce operators - from large platforms to a mid-sized municipal IT team in rybnik running a local government shop - availability is directly tied to revenue and public trust, so even a pure availability impact warrants prompt attention. No CISA KEV listing and no public POC are present, which moderates real-world urgency; opportunistic scanners, however, could easily automate this given AC:L and PR:N. EPSS data is not supplied, so exploitation probability cannot be quantified from available signals. Overall, this is a genuine medium-high priority for any publicly accessible WooCommerce installation, primarily because of the product's massive deployment footprint and the revenue impact of storefront downtime. |
| Exploit ScenarioDerived | An attacker identifies a publicly accessible WooCommerce store running a version below 11.1.0 and sends a high volume of specially crafted HTTP requests to an unthrottled endpoint. The server allocates unbounded resources for each request - memory, database connections, or compute - until PHP-FPM or the web server runs out of available workers, causing the storefront and WP-Admin to return 503 errors for all users. No authentication or prior account registration is required, and the low attack complexity means this can be scripted trivially with standard HTTP tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Unauthenticated HTTP Denial of Service in WooCommerce (all versions before 11.1.0) allows remote attackers to exhaust server resources without any credentials, rendering affected storefronts and admin panels unavailable. The root cause is CWE-770 - missing throttling or resource allocation limits on one or more HTTP-accessible endpoints within the plugin. Patchstack reported the issue and a patched release (11.1.0) is available; no active exploitation or public proof-of-concept code has been identified at time of analysis.
RemediationAI
Upgrade WooCommerce to version 11.1.0 or later, which is the vendor-released patch per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-11-1-0-denial-of-service-attack-vulnerability). WordPress site administrators can apply this through the WP-Admin Plugins update screen or via WP-CLI (wp plugin update woocommerce). Where immediate patching is not feasible, deploy a Web Application Firewall or CDN-level rate-limiting rule targeting the specific WooCommerce endpoints to restrict the number of requests per IP per time window; this limits attack throughput but does not eliminate the underlying flaw and may inadvertently throttle legitimate high-volume shoppers during peak sales events. Additionally, server-level configuration such as PHP-FPM process limits or nginx worker connection caps can reduce blast radius but will not prevent resource exhaustion entirely.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WooCommerce (CPE: cpe:2.3:a:automattic:woocommerce:*:*:*:*:*:*:*:*) is an Automattic-maintained e-commerce plugin for WordPress. The vulnerability class is CWE-770 (Allocation of Resources Without Limits or Throttling): the plugin processes certain HTTP requests without enforcing per-request or per-client resource ceilings, allowing a single remote client to trigger unbounded server-side processing - CPU cycles, memory, or database queries - until the host is overwhelmed. Because WooCommerce runs atop WordPress (PHP/Apache or nginx), resource exhaustion at the plugin layer cascades to the entire WordPress installation, taking down both the public storefront and the WP-Admin interface.
Know when Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no auth or user interaction; only availability impacted - no confidentiality or integrity consequence from a resource-exhaustion DoS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.
This issue affects WooCommerce: from n/a before 11.1.0.
Articles & Coverage 2
Executive ViewAI
WooCommerce storefronts running versions before 11.1.0 are vulnerable to unauthenticated denial-of-service attacks that can crash online stores and admin panels without requiring credentials. This vulnerability directly threatens revenue generation and operational continuity for all affected e-commerce businesses. Immediate upgrade to version 11.1.0 or later is required to restore resilience.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
Unauthenticated remote code execution in Print Invoice & Delivery Notes for WooCommerce through 5.8.0 lets remote attack
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to a
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Unauthenticated path traversal in OrderConvo (the "Admin and Customer Messages After Order for WooCommerce" plugin), aff
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execu
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Stored cross-site scripting in the PDF Invoices & Packing Slips for WooCommerce plugin (5.16.2 up to, but not including,
Exploit-DB