WooCommerce <= 11.1.0 - REST API Key Scope Bypass via Non-REST Requests
- ID
- WPSEC-2026-0177
- Plugin
- WooCommerce (woocommerce)
- Affected
- all versions before 11.1.1
- Remediation
- Update to 11.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-287
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The WooCommerce plugin for WordPress is vulnerable to Improper Authentication in all versions up to, and including, 11.1.0. WooCommerce decided whether to apply its REST API key authentication from the request URL without confirming that WordPress was dispatching a REST request: before 11.1.0 any URL containing the REST prefix followed by 'wc/' matched, including in the query string, and in 11.1.0 a 'rest_route' query parameter did. This makes it possible for someone holding a WooCommerce REST API key, including a read-only key, to be authenticated as the key's owner on non-REST requests such as admin-ajax.php, where the key's read/write permission is not enforced.
References
- https://wpsec.com/vuln/WPSEC-2026-0177/
- https://plugins.svn.wordpress.org/woocommerce/tags/11.1.1/
- https://wordpress.org/plugins/woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS