EUVD-2026-97296
GHSA-hc67-c8xg-c5xq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WooCommerce site over network
-
DeliverySend request to unprotected plugin action
-
ExploitBypass missing authorization check
-
ExecutionPerform unauthorized state change
-
ImpactAlter product access restrictions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a WordPress site running WooCommerce with the Codection 'Products Restricted Users for WooCommerce' plugin installed and active at version 0.7 or earlier. Per CVSS (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed against a default install, so the plugin's mere presence exposes the vulnerable endpoint. The main limiting factors are the narrow deployment footprint of this specific plugin and the low integrity-only impact (C:N/A:N), meaning successful exploitation yields unauthorized modification of plugin-controlled access-restriction state rather than data disclosure or denial of service. |
| Impact | This is a moderate, not high, priority. The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) describes a remotely reachable, low-complexity, unauthenticated flaw whose only consequence is a LOW integrity impact - no confidentiality or availability loss. That limited impact is consistent with CWE-862 (Missing Authorization), where an attacker reaches a function they should not be able to call but cannot read sensitive data or take the site down. No EPSS score, KEV listing, or public POC was provided in the input, so there is no positive signal of real-world exploitation; absence of these is not proof of safety but there is nothing here elevating this above its base score. The only source is a single Patchstack advisory, so the technical details are vendor-reported and not independently corroborated by NVD analysis in the data provided. Net: a legitimate issue to patch on affected sites, but it reads as a routine broken-access-control bug in a niche plugin rather than an urgent, widely-exploited threat. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a direct request to a plugin endpoint or action that lacks a proper capability/authorization check, causing it to perform a state-changing operation (e.g., altering a product-restriction setting) that should require privileges. No public exploit code was identified at the time of analysis, and because CVSS impact is limited to low integrity, the practical effect is unauthorized modification rather than full site compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Missing authorization in the Codection 'Products Restricted Users for WooCommerce' WordPress plugin, version 0.7 and earlier, allows unauthenticated remote attackers to bypass the plugin's access-control logic and alter which products are restricted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required against a default installation, although the impact is limited to low integrity (C:N/I:L/A:N) on plugin-controlled restriction state rather than data disclosure or denial of service. No public exploit code was identified at time of analysis, and the plugin has a narrow deployment footprint, so this is a moderate rather than high priority finding.
RemediationAI
No vendor-released patch is identified at time of analysis; the advisory lists no fixed version, only the affected range through 0.7, so verify with Codection/Patchstack whether a corrected release has since appeared and upgrade to it if so. Until a fix is confirmed, the most direct control is to deactivate and remove the plugin if its product-restriction features are not essential - the trade-off is loss of that functionality, so replace it with a maintained alternative or WooCommerce's native catalog visibility settings. If the plugin must stay active, restrict reach to its endpoints: front the site with a WAF or reverse-proxy rule that blocks unauthenticated requests to the plugin's PHP files and admin-ajax/REST routes, and add server-level rules (for example .htaccess or nginx location blocks) to deny direct access to the plugin directory; the trade-off is potential breakage of legitimate front-end restriction logic and a maintenance burden as request paths change. Because exploitation causes unauthorized modification of restriction state rather than disclosure, add integrity monitoring or logging on plugin settings and periodically re-audit which products are restricted, so tampering is detected and reverted quickly. Note that none of these compensating controls address the root cause, and all should be removed once a patched version is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-862 Missing Authorization condition in a WordPress/WooCommerce plugin. The component, identified by the CPE cpe:2.3:a:codection:products_restricted_users_for_woocommerce (all versions marked with a wildcard, i.e. everything up to and including 0.7), extends WooCommerce so that administrators can hide or restrict specific products from selected users or roles. Its restriction-management functionality is reachable over the network but fails to perform a capability or nonce check before processing requests, so a caller who is not authenticated and holds no WordPress capability can invoke the affected operation. Because the endpoint is served through the normal WordPress HTTP surface, an unauthenticated request is sufficient; nothing in the CVSS vector requires a session, a valid account, or victim interaction. The practical consequence is a modification of the plugin's access-restriction configuration (integrity-only), not exposure of restricted product data or a denial of service, which is consistent with the low integrity, no confidentiality, no availability assessment.
Know when Products Restricted Users For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Missing authorization on a network-reachable endpoint needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); effect is unauthorized state change, so I:L with C:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB