WooCommerce vulnerabilities

4 known vulnerabilities in WooCommerce from Automattic. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  WooCommerce: Incorrect Privilege Assignment

  CVE-2026-106608Oct 10, 2026Automattic

  Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

• 7.5 High severity

  WooCommerce: Allocation of Resources Without Limits or Throttling

  CVE-2026-48888Sep 8, 2026Automattic

  Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.

• 7.6 High severity

  WooCommerce: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-57777Sep 4, 2026Automattic

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0.

• 7.5 High severity

  WooCommerce: Cross-Site Request Forgery

  CVE-2026-3589Mar 6, 2026Automattic

  The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for e