WPC Shop-as-Customer EUVD-2026-90568

Exploitation requires an authenticated account on the target WordPress/WooCommerce site (PR:L) and that the WPC Shop as a Customer for WooCommerce plugin (version <=2.0.0) is installed and active. The attacker must reach the wpcsa_login endpoint and supply the target Administrator's user ID (WordPress user IDs are low, enumerable, and often guessable - e.g., ID 1). No password, nonce bypass, user interaction, or non-default configuration is otherwise needed; the defect is in the endpoint's missing role validation itself. The limiting factor is solely the need for any authenticated session, which is low-friction given the plugin's customer-impersonation purpose.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) is well-justified: an authenticated low-privileged user can escalate to full Administrator with network access and low complexity, yielding complete confidentiality, integrity, and availability impact. The flaw is a logic/authorization defect (CWE-269) - the wpcsa_login endpoint issues an Administrator session cookie without password or role validation - so exploitation is deterministic and reliable once the attacker has any authenticated foothold, which strongly favors real-world abuse. Countervailing signals lowering urgency: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no confirmation of active exploitation. The one true gating factor is PR:L - the attacker must first obtain an authenticated account; however, the plugin's 'shop as a customer' impersonation purpose means low-privileged accounts (e.g., shop managers or any registered customer, depending on configuration) are exactly the intended user base, making the prerequisite easy to meet on many stores. Net: a reliable, trivially-weaponizable account-takeover primitive with no exploitation observed yet - patch promptly where the plugin is installed.

An attacker registers or already holds a low-privileged authenticated account on a WooCommerce store running the vulnerable plugin. They send a request to the wpcsa_login endpoint supplying a known Administrator's user ID (e.g., ID 1) instead of a customer ID; the plugin fails to check the target role and returns a valid Administrator session cookie with no password required. No public proof-of-concept is referenced, but the attack is network-based, low-complexity, and fully scriptable.