CVE-2026-9766

Name of the Vulnerable Software and Affected Versions Empik for Woocommerce versions prior to 1.5.2

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can modify arbitrary WooCommerce product metadata. Affected data includes the Empik logistic class empik logistic klass, product state empik product state and empik product state all variants, as well as Empik export and offer flags for any product in the store.

Recommendations Update the plugin to a version newer than 1.5.1.