EUVD-2026-85855
GHSA-jp8r-42gx-hfwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site with vulnerable plugin ≤1.1.2
-
DeliverySend unauthenticated request to save_option() action
-
ExploitMissing capability check permits call
-
ExecutionExport or reset plugin settings
-
ImpactConfig disclosure or data loss
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default installations of the Custom Thank You Page for WooCommerce plugin (versions up to and including 1.1.2). The only prerequisites are that the vulnerable plugin is installed and active and that the site is network-reachable; no authentication, user interaction, or non-default configuration is required. Impact is limited to the plugin's own settings (export/disclosure or reset/deletion), not the broader WordPress site or WooCommerce order data, which bounds real-world severity. |
| Impact | This is a genuine but moderate-priority issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5 MEDIUM) is internally consistent with the description: a missing capability check on save_option() lets a fully unauthenticated remote attacker either export the plugin's settings (low confidentiality impact) or reset/delete them (low integrity impact). There is no availability impact to the site as a whole - only the plugin's own configuration is affected. No EPSS score, KEV listing, or public exploit code is present in the supplied data, so this is not confirmed to be exploited and there is no evidence of mass exploitation; the real-world threat is opportunistic rather than urgent. The main things elevating it above a trivial issue are the total absence of authentication (PR:N) and low attack complexity (AC:L), which make drive-by abuse against exposed sites easy. The main things dampening it are the strictly LOW/LOW impact (no RCE, no full data theft, no site takeover) and the niche nature of the affected plugin. No key signals conflict - description and CVSS vector align on unauthenticated network access with limited impact. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers a WordPress store running the Custom Thank You Page for WooCommerce plugin (<=1.1.2) and sends a crafted request to the unprotected save_option() action. They export the plugin's stored settings (information disclosure) or invoke the reset function to wipe the plugin's configuration, breaking the store's custom post-purchase thank-you flow. No public exploit code is identified at time of analysis, but the flaw is trivial to reach given no authentication and low complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Unauthenticated remote attackers can export or wipe the configuration of the Custom Thank You Page for WooCommerce WordPress plugin in all versions up to and including 1.1.2, because the save_option() function is reachable without any capability or nonce check. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and is bounded to the plugin's own settings - order data and the wider WordPress site are not directly at risk - which keeps it a genuine but moderate-priority finding rather than a site-takeover bug. No public exploit code has been identified at time of analysis, and the plugin's Trac changeset suggests an upstream fix has been committed.
RemediationAI
Upstream fix available via WordPress.org Trac changeset 3507079 (referenced at https://plugins.trac.wordpress.org/changeset/3507079); the released patched version is not independently confirmed, so administrators should update the plugin through the WordPress dashboard to the newest available release above 1.1.2 and verify the version number afterwards. If an update incorporating that changeset is not yet installable on the site, the cleanest compensating control is to deactivate and, where feasible, delete the plugin, since it provides only a cosmetic thank-you page customization and removing it costs the site nothing beyond that feature. If the plugin must remain active, a WAF or reverse-proxy rule that blocks unauthenticated POST requests to the plugin's settings-handling action (via admin-ajax.php or the plugin's REST route) mitigates the missing capability check, but such rules are brittle because the request shape is not standardized in the supplied data and may break legitimate admin workflows. Operators should also treat the plugin's settings as potentially lost - maintaining an external copy of the configured thank-you page content allows quick restoration if an attacker has already triggered the reset/delete path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-862 Missing Authorization defect in a WordPress plugin. WordPress plugins commonly expose administrative actions through admin-ajax.php or the REST API; secure implementations gate those callbacks with current_user_can() checks and nonce verification. Here the save_option() handler that writes (or, per the advisory, exports and resets) the plugin's option record was registered without an authorization check, so any network-reachable request - whether or not the caller is logged in - can invoke it. The CPE cpe:2.3:a:alexvtn:custom_thank_you_page_for_woocommerce:*:*:*:*:*:*:*:* confirms every released version of the alexvtn plugin is in scope, and the CVSS vector's PR:N/N/AC:L combination matches the independent assessment that no authentication, user interaction, or non-default configuration is required. The integrity and confidentiality impact is Limited (C:L/I:L) precisely because the affected data is scoped to the plugin's own option row: an attacker can disclose that configuration or delete/reset it, degrading the store's customized thank-you page behaviour, but cannot pivot to WooCommerce order records or core WordPress data through this vector alone. The absence of an availability component (A:N) is consistent with a settings-only reset rather than a denial-of-service condition against the site.
Know when Custom Thank You Page For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Missing capability check allows unauthenticated remote calls (AV:N/AC:L/PR:N/UI:N); settings export gives C:L and reset/delete gives I:L, with no site-wide availability impact (A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the save_option() function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or reset(delete) the plugin's settings.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB