Skip to content
OpenAdvisories

Product · Automattic

WooCommerce

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.2
    CVE-2026-106608

    WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

    Automattic WooCommerce Web / CMS
  • High 7.5
    CVE-2026-48888

    WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability

    Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.

    Automattic WooCommerce Web / CMS
  • High 7.6
    CVE-2026-57777

    WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0.

    Automattic WooCommerce Web / CMS
  • High 7.5
    CVE-2026-3589

    WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

    The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for …

    Automattic WooCommerce Web / CMS