WooCommerce <= 11.1.0 - Authenticated (Shop Manager+) Privilege Escalation via Mobile App QR Login Token Generation
- ID
- WPSEC-2026-0178
- Plugin
- WooCommerce (woocommerce)
- Affected
- from 10.9.0 before 11.1.1
- Remediation
- Update to 11.1.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-287
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions 10.9.0 up to, and including, 11.1.0 via the mobile app QR login REST endpoints. They only checked the manage_woocommerce capability and did not require an interactive logged-in browser session or a REST nonce. This makes it possible for someone holding a non-interactive credential of a Shop Manager-level or higher user, such as a WooCommerce REST API key, to complete the QR login flow and obtain a new Application Password for that user, which carries the user's full REST API access rather than the narrower scope of the original credential.
References
- https://wpsec.com/vuln/WPSEC-2026-0178/
- https://plugins.svn.wordpress.org/woocommerce/tags/11.1.1/
- https://wordpress.org/plugins/woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS