CVE-2026-14941

Name of the Vulnerable Software and Affected Versions Customer Reviews for WooCommerce versions prior to 5.116.0

Description The plugin fails to perform nonce (a unique token used to prevent cross-site request forgery) or capability checks on several settings-related AJAX actions. This allows users with minimal permissions, such as Subscribers, to invoke administrative settings handlers, update plugin options, and disclose store configuration.

Recommendations Update to version 5.116.0 or later.