Description
The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Automattic | WooCommerce | 5.4.0 – < 5.4.4, 5.5.0 – < 5.4.5, 5.6.0 – < 5.6.3, 5.7.0 – < 5.7.3, 5.8.0 – < 5.8.2, 5.9.0 – < 5.9.2, 6.0.0 – < 6.0.2, 6.1.0 – < 6.1.3, 6.2.0 – < 6.2.3, 6.3.0 – < 6.3.2, 6.4.0 – < 6.4.2, 6.5.0 – < 6.5.2, 6.6.0 – < 6.6.2, 6.7.0 – < 6.7.1, 6.8.0 – < 6.8.3, 6.9.0 – < 6.9.5, 7.0.0 – < 7.0.2, 7.1.0 – < … | 5.4.4 |
References
- https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/ exploit vdb-entry technical-description
- https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/ technical-description