blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-86785

MEDIUM 5.3 CVSS 3.1
Published
September 23, 2026
Last modified
September 23, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.

Affected products and versions

  • Unknown Social Commerce for WooCommerce — Up to and including 2.5.4

References

  • wpscan.com https://wpscan.com/vulnerability/9a4c36bd-c7f7-4068-ac73-b29ee66def96/
  • nvd.nist.gov Official NVD record