blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-3589

HIGH 7.5 CVSS 3.1
Published
March 6, 2026
Last modified
June 17, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.

Affected WordPress components

  • WooCommerce Plugin · woocommerce
    Confirmed match Active
    From 9.9.0 (including) to 9.9.7 (excluding); From 5.4.0 (including) to 5.4.4 (excluding); From 5.5.0 (including) to 5.4.5 (excluding); From 5.6.0 (including) to 5.6.3 (excluding); From 5.7.0 (including) to 5.7.3 (excluding); From 5.8.0 (including) to 5.8.2 (excluding); From 5.9.0 (including) to 5.9.2 (excluding); From 6.0.0 (including) to 6.0.2 (excluding); From 6.1.0 (including) to 6.1.3 (excluding); From 6.2.0 (including) to 6.2.3 (excluding); From 6.3.0 (including) to 6.3.2 (excluding); From 6.4.0 (including) to 6.4.2 (excluding); From 6.5.0 (including) to 6.5.2 (excluding); From 6.6.0 (including) to 6.6.2 (excluding); From 6.7.0 (including) to 6.7.1 (excluding); From 6.8.0 (including) to 6.8.3 (excluding); From 6.9.0 (including) to 6.9.5 (excluding); From 7.0.0 (including) to 7.0.2 (excluding); From 7.1.0 (including) to 7.1.2 (excluding); From 7.2.0 (including) to 7.2.4 (excluding); From 7.3.0 (including) to 7.3.1 (excluding); From 7.4.0 (including) to 7.4.2 (excluding); From 7.5.0 (including) to 7.5.2 (excluding); From 7.6.0 (including) to 7.6.2 (excluding); From 7.7.0 (including) to 7.7.3 (excluding); From 7.8.0 (including) to 7.8.4 (excluding); From 7.9.0 (including) to 7.9.2 (excluding); From 8.0.0 (including) to 8.0.5 (excluding); From 8.1.0 (including) to 8.1.4 (excluding); From 8.2.0 (including) to 8.2.5 (excluding); From 8.3.0 (including) to 8.3.4 (excluding); From 8.4.0 (including) to 8.4.3 (excluding); From 8.5.0 (including) to 8.5.5 (excluding); From 8.6.0 (including) to 8.6.4 (excluding); From 8.7.0 (including) to 8.7.3 (excluding); From 8.8.0 (including) to 8.8.7 (excluding); From 8.9.0 (including) to 8.9.5 (excluding); From 9.0.0 (including) to 9.0.4 (excluding); From 9.1.0 (including) to 9.1.7 (excluding); From 9.2.0 (including) to 9.2.5 (excluding); From 9.3.0 (including) to 9.3.6 (excluding); From 9.4.0 (including) to 9.4.5 (excluding); From 9.5.0 (including) to 9.5.4 (excluding); From 9.6.0 (including) to 9.6.4 (excluding); From 9.7.0 (including) to 9.7.3 (excluding); From 9.8.0 (including) to 9.8.7 (excluding); From 10.0.0 (including) to 10.0.6 (excluding); From 10.1.0 (including) to 10.1.4 (excluding); From 10.2.0 (including) to 10.2.4 (excluding); From 10.3.0 (including) to 10.3.8 (excluding); From 10.4.0 (including) to 10.4.4 (excluding); From 10.5.0 (including) to 10.5.3 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Automattic WooCommerce — From 5.4.0 (including) to 5.4.4 (excluding)
  • Automattic WooCommerce — From 5.5.0 (including) to 5.4.5 (excluding)
  • Automattic WooCommerce — From 5.6.0 (including) to 5.6.3 (excluding)
  • Automattic WooCommerce — From 5.7.0 (including) to 5.7.3 (excluding)
  • Automattic WooCommerce — From 5.8.0 (including) to 5.8.2 (excluding)
  • Automattic WooCommerce — From 5.9.0 (including) to 5.9.2 (excluding)
  • Automattic WooCommerce — From 6.0.0 (including) to 6.0.2 (excluding)
  • Automattic WooCommerce — From 6.1.0 (including) to 6.1.3 (excluding)
  • Automattic WooCommerce — From 6.2.0 (including) to 6.2.3 (excluding)
  • Automattic WooCommerce — From 6.3.0 (including) to 6.3.2 (excluding)
  • Automattic WooCommerce — From 6.4.0 (including) to 6.4.2 (excluding)
  • Automattic WooCommerce — From 6.5.0 (including) to 6.5.2 (excluding)
  • Automattic WooCommerce — From 6.6.0 (including) to 6.6.2 (excluding)
  • Automattic WooCommerce — From 6.7.0 (including) to 6.7.1 (excluding)
  • Automattic WooCommerce — From 6.8.0 (including) to 6.8.3 (excluding)
  • Automattic WooCommerce — From 6.9.0 (including) to 6.9.5 (excluding)
  • Automattic WooCommerce — From 7.0.0 (including) to 7.0.2 (excluding)
  • Automattic WooCommerce — From 7.1.0 (including) to 7.1.2 (excluding)
  • Automattic WooCommerce — From 7.2.0 (including) to 7.2.4 (excluding)
  • Automattic WooCommerce — From 7.3.0 (including) to 7.3.1 (excluding)
  • Automattic WooCommerce — From 7.4.0 (including) to 7.4.2 (excluding)
  • Automattic WooCommerce — From 7.5.0 (including) to 7.5.2 (excluding)
  • Automattic WooCommerce — From 7.6.0 (including) to 7.6.2 (excluding)
  • Automattic WooCommerce — From 7.7.0 (including) to 7.7.3 (excluding)
  • Automattic WooCommerce — From 7.8.0 (including) to 7.8.4 (excluding)
  • Automattic WooCommerce — From 7.9.0 (including) to 7.9.2 (excluding)
  • Automattic WooCommerce — From 8.0.0 (including) to 8.0.5 (excluding)
  • Automattic WooCommerce — From 8.1.0 (including) to 8.1.4 (excluding)
  • Automattic WooCommerce — From 8.2.0 (including) to 8.2.5 (excluding)
  • Automattic WooCommerce — From 8.3.0 (including) to 8.3.4 (excluding)
  • Automattic WooCommerce — From 8.4.0 (including) to 8.4.3 (excluding)
  • Automattic WooCommerce — From 8.5.0 (including) to 8.5.5 (excluding)
  • Automattic WooCommerce — From 8.6.0 (including) to 8.6.4 (excluding)
  • Automattic WooCommerce — From 8.7.0 (including) to 8.7.3 (excluding)
  • Automattic WooCommerce — From 8.8.0 (including) to 8.8.7 (excluding)
  • Automattic WooCommerce — From 8.9.0 (including) to 8.9.5 (excluding)
  • Automattic WooCommerce — From 9.0.0 (including) to 9.0.4 (excluding)
  • Automattic WooCommerce — From 9.1.0 (including) to 9.1.7 (excluding)
  • Automattic WooCommerce — From 9.2.0 (including) to 9.2.5 (excluding)
  • Automattic WooCommerce — From 9.3.0 (including) to 9.3.6 (excluding)
  • Automattic WooCommerce — From 9.4.0 (including) to 9.4.5 (excluding)
  • Automattic WooCommerce — From 9.5.0 (including) to 9.5.4 (excluding)
  • Automattic WooCommerce — From 9.6.0 (including) to 9.6.4 (excluding)
  • Automattic WooCommerce — From 9.7.0 (including) to 9.7.3 (excluding)
  • Automattic WooCommerce — From 9.8.0 (including) to 9.8.7 (excluding)
  • Automattic WooCommerce — From 9.9.0 (including) to 9.9.7 (excluding)
  • Automattic WooCommerce — From 10.0.0 (including) to 10.0.6 (excluding)
  • Automattic WooCommerce — From 10.1.0 (including) to 10.1.4 (excluding)
  • Automattic WooCommerce — From 10.2.0 (including) to 10.2.4 (excluding)
  • Automattic WooCommerce — From 10.3.0 (including) to 10.3.8 (excluding)
  • Automattic WooCommerce — From 10.4.0 (including) to 10.4.4 (excluding)
  • Automattic WooCommerce — From 10.5.0 (including) to 10.5.3 (excluding)

References

  • developer.woocommerce.com https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/
  • wpscan.com https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/
  • nvd.nist.gov Official NVD record