CVE-2026-81428

Name of the Vulnerable Software and Affected Versions WC Vendors versions prior to 2.7.2.1

Description An Insecure Direct Object Reference (IDOR) exists when saving product variations. The software fails to verify the object type or ownership of user-supplied IDs, which allows authenticated users with the vendor role to modify product variations belonging to other vendors. Additionally, this flaw enables the modification of the status and title of arbitrary posts.

Recommendations Update WC Vendors to version 2.7.2.1 or later.