PT-2026-23668

CVE-2026-3589

Published

2026-03-06

Updated

2026-03-30

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce versions 5.4.0 through 10.5.2

Description The WooCommerce WordPress plugin does not properly handle batch requests, potentially allowing unauthenticated users to execute administrative actions on non-store REST endpoints. This could enable the creation of arbitrary administrator users through a Cross-Site Request Forgery (CSRF) attack.

Recommendations Update WooCommerce to a version later than 10.5.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Oolongeya

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers