Vulnerabilities / WooCommerce
WooCommerce vulnerabilities
Advisories WPSec published for WooCommerce. Other sources may list more. Its attack surface: WooCommerce on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-08 | WPSEC-2026-0657 | WooCommerce <= 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation via Editing Users with Multiple Roles | Medium 6.6 | 11.2.0 |
| 2026-10-08 | WPSEC-2026-0656 | WooCommerce <= 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation via Account Takeover through Password Reset Email Cc/Bcc Recipients | High 7.2 | 11.2.0 |
| 2026-10-02 | WPSEC-2026-0221 | WooCommerce <= 11.1.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via REST API v1/v2 Product Review Creation | Medium 5.5 | 11.1.2 |
| 2026-10-01 | WPSEC-2026-0178 | WooCommerce <= 11.1.0 - Authenticated (Shop Manager+) Privilege Escalation via Mobile App QR Login Token Generation | Low 3.8 | 11.1.1 |
| 2026-10-01 | WPSEC-2026-0177 | WooCommerce <= 11.1.0 - REST API Key Scope Bypass via Non-REST Requests | Medium 4.2 | 11.1.1 |
License: CC BY 4.0