EUVD-2026-89870
GHSA-9vm7-v26c-hrgr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Subscriber-level account
-
ExploitIdentify unprotected plugin action endpoint
-
ExecutionSend request missing authorization check
-
ImpactModify gateway/store state (integrity impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the MakeCommerce for WooCommerce plugin at version 4.1.0 or earlier on a WordPress/WooCommerce store. Per the 'Subscriber Broken Access Control' title, exploitation requires at least a low-privilege authenticated Subscriber account (open registration is common on WooCommerce stores, lowering this barrier), invoking a plugin action that is missing its capability check. This authentication prerequisite conflicts with the supplied PR:N vector and limits exploitation to accounts on the target site; no user interaction is needed. The exact vulnerable endpoint/parameter is not disclosed in the available data. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) scores 8.2 (High) and models a network-reachable, low-complexity, unauthenticated flaw with high integrity impact. However, this conflicts with the vulnerability title 'Subscriber Broken Access Control,' which indicates a logged-in Subscriber-level account (PR:L) is actually required - a common Patchstack labeling convention. This PR:N-vs-Subscriber discrepancy materially changes real-world risk: if a Subscriber account is genuinely needed, the practical vector is authenticated (PR:L) and the honest score is closer to 6.5. No EPSS score, SSVC decision data, KEV listing, or POC was provided, so no exploitation-probability or automatability signal is available. There is no evidence of active exploitation (not in CISA KEV) and no public exploit identified. The impact profile is integrity-centric (C:N/I:H/A:L) - consistent with a missing authorization check letting a low-privilege user invoke a state-changing action (e.g. modifying order/payment configuration or triggering a gateway operation) rather than reading sensitive data. Net: a real but moderate-priority issue against a niche plugin, not a widespread emergency; the authentication prerequisite should be verified with the Patchstack advisory before treating it as unauthenticated. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privilege Subscriber account on a WooCommerce store running the MakeCommerce plugin (<= 4.1.0), then sends a crafted request to an action endpoint that lacks a proper capability/authorization check. Because the check is missing, the request succeeds and alters store or payment-gateway state the user should not control, undermining data integrity. No public proof-of-concept was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Broken access control in the MakeCommerce for WooCommerce WordPress plugin (versions up to and including 4.1.0) lets a low-privilege authenticated Subscriber reach a plugin action that is missing its capability check, allowing unauthorized modification of store data. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) scores 8.2, but our independent assessment adjusts the privilege requirement to PR:L, since the 'Subscriber Broken Access Control' classification implies an authenticated Subscriber session is needed; open registration on many WooCommerce stores makes obtaining such an account trivial. The result is high integrity impact and limited availability impact with no confidentiality exposure, no user interaction required, and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, and no fixed version is specified in the available data, so remediation must rely on compensating controls until MakeCommerce publishes an update past 4.1.0. The most direct mitigation is to deactivate and, if possible, remove the MakeCommerce for WooCommerce plugin from stores that do not require it; the trade-off is loss of the MakeCommerce payment integration until a fix ships. Where the gateway cannot be removed, restrict the plugin's administrative actions by hardening account provisioning: disable open Subscriber registration or require administrator approval for new accounts, which removes the low-privilege foothold the exploit depends on, at the cost of added friction for legitimate customers. Layer additional access control by deploying a WordPress security plugin or WAF rule set that enforces capability and nonce checks on plugin AJAX/REST endpoints and blocks unauthenticated or low-privilege requests to plugin paths; this reduces exposure but can break legitimate storefront behaviour if rules are too broad, so test in staging. Also review logs for unexpected Subscriber-initiated calls to plugin endpoints and audit payment, order, and gateway configuration records for unauthorized changes. Monitor the Patchstack advisory and the vendor's release channel for a patched version and apply it as soon as it is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-862 Missing Authorization defect in the MakeCommerce for WooCommerce plugin, a payment-gateway integration for WordPress/WooCommerce stores, tracked as CPE cpe:2.3:a:makecommerce.net:makecommerce_for_woocommerce. Rather than a memory-safety or injection issue, the root cause is the absence of a proper capability or nonce check on a plugin endpoint, so a request from an account with only Subscriber-level privileges is processed with the trust level intended for higher-privileged users (shop managers or administrators). This class of bug is common in WordPress plugins because routes registered through admin-ajax.php or the REST API rely on developer-supplied permission callbacks; when that callback is missing or checks only is_user_logged_in(), any authenticated user can invoke the handler. The exact vulnerable endpoint and parameter set are not disclosed in the available data, which limits precise reproduction, but the integrity-focused impact (C:N/I:H/A:L) indicates the action mutates stored state - for example, altering transaction, order, or gateway configuration data - rather than disclosing secrets. Note that the reported CVSS vector's PR:N rating conflicts with the Subscriber framing; the authoritative assessment applies PR:L, meaning an account on the target site is a prerequisite.
Know when Makecommerce For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Title 'Subscriber' indicates a required low-privilege account (PR:L, not PR:N); network vector, low complexity, integrity-primary impact with no confidentiality and low availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.
Executive ViewAI
The MakeCommerce for WooCommerce plugin, versions up to and including 4.1.0, can allow unauthorized changes to store data by a low-privilege Subscriber account. For organizations running WooCommerce with open registration, this threatens the accuracy and trustworthiness of orders, catalog, and customer-facing data, and could force manual reconciliation or temporary checkout disruption. Leadership should prioritize mitigation because No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing the MakeCommerce for WooCommerce plugin where feasible, restricting or removing Subscriber-level access, disabling open registration or requiring approval, applying WAF/virtual patching rules to block the vulnerable action, and monitoring/auditing store data and logs for unauthorized modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB