WooCommerce vulnerabilities
We track 20 vulnerabilities in WooCommerce products across 15 products. 20 are rated high or critical, and none are known to be exploited. The most recent was published on June 20, 2026.
Latest WooCommerce vulnerabilities
- 9.8 Critical severity
WooCommerce: Improper Control of Generation of Code
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoin
- 8.2 High severity
WooCommerce PayPal Payments: Missing Authorization
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and incl
- 7.5 High severity
WooCommerce Square: Authorization Bypass Through User-Controlled Key
The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_id function due to missing validation on a user controlled key. This makes it possible for unauthenti
- 8.2 High severity
Flexible Woocommerce Checkout Field Editor: Missing Authorization
Missing Authorization vulnerability in heoLixfy Flexible Woocommerce Checkout Field Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Woocommerce Checkout Field Editor: from n/a through 2.0.1.
- 7.5 High severity
TI WooCommerce Wishlist: Missing Authorization
The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function in all versions up to, and including, 2.9.1. This makes it possible for unauthenticated attackers to
- 9.8 Critical severity
WooCommerce Upload Files: Unrestricted Upload of File with Dangerous Type
The WooCommerce Upload Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload_files() function in all versions up to, and including, 84.3. This makes it possible for unauthenticated attackers to upl
- 9.8 Critical severity
CartBounty – Save and recover abandoned carts…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in Streamline CartBounty – Save and recover abandoned carts for WooCommerce woo-save-abandoned-carts allows Cross Site Request Forgery.This issue affects CartBounty – Save and recover abandoned carts for WooComme
- 8.1 High severity
WooCommerce Customers Manager: Cross-Site Request Forgery
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
- 9.8 Critical severity
WooCommerce Stripe Payment Gateway: Missing Authorization
Missing Authorization vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.4.0.
- 7.6 High severity
WooCommerce One Page Checkout: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File Inclusion.This issue affects WooCommerce One Page Checkout: from n/a through 2.3.0.
- 8.1 High severity
WooCommerce Customers Manager: Improper Neutralization of Special Elements used in an SQL Command
The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.
- 8.8 High severity
WooCommerce Stripe Payment Gateway: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.0.
- 9.8 Critical severity
WooCommerce Stripe Payment Gateway: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1.
- 7.5 High severity
WooCommerce Bookings: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78.
- 7.5 High severity
Woo Subscriptions: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.
- 8.1 High severity
AutomateWoo: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.50.
- 8.1 High severity
WooCommerce Square: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.
- 7.2 High severity
Product Vendors: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.76.
- 8.8 High severity
Canada Post Shipping Method: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3.
- 9.8 Critical severity
Product Vendors: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78.