blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-12736

HIGH 8.0 CVSS 3.1
Published
July 24, 2026
Last modified
July 24, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-269
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Description

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).

Affected WordPress components

  • WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce Plugin · wpify-woo
    Confirmed match Active
    Up to and including 5.4.16
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • wpify WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce — Up to and including 5.4.16

References