blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-88828

MEDIUM 5.4 CVSS 3.1
Published
September 28, 2026
Last modified
September 28, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-288
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.

Affected products and versions

  • Unknown Blacklist Manager — From 1.3.0 (including) to 2.3.2 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/52804421-8988-4d8a-9143-04683d05873d/
  • nvd.nist.gov Official NVD record