CVE-2026-16947

The Total processing card payments for WooCommerce WordPress plugin (versions through 7.3 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause is the failure to validate a user-supplied path used to build a server-side verification request and the lack of auth...

WordPress Return Refund and Exchange For WooCommerce plugin < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation vulnerability

Unauthenticated Guest Order Message Disclosure and Manipulation vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Return Refund and Exchange For WooCommerce versions 4.6.4...

WordPress DHL for WooCommerce plugin < 4.0.1 - Unauthenticated Shipping Label Download via IDOR vulnerability

Unauthenticated Shipping Label Download via IDOR vulnerability discovered by Pedro Pinho, Artus KG in WordPress Plugin DHL Shipping Germany for WooCommerce versions 4.0.1...

CVE-2026-16569 ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

EUVD-2026-66871

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

CVE-2026-16569

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin, in versions through 0.4.62 , contains an improper access control vulnerability. The plugin fails to verify user permissions before performing stock-update operations via one of its REST endpoint...

PT-2026-82388

Name of the Vulnerable Software and Affected Versions ShopApper Mobile App Builder Service for WooCommerce WordPress plugin versions prior to 0.4.63 Description The plugin fails to verify user permissions before performing stock-update operations via a REST endpoint. This allows any authenticated...

CVE-2026-77695

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

EUVD-2026-66283

The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the si...

EUVD-2026-64797

Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...

CVE-2026-18027

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.9.8 . The flaw resides in the get_image_src_in_base64 function, which processes the customer_note parameter witho...

CVE-2026-18027 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...

CVE-2026-18027 WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the getimagesrcinbase64 function. This makes it possible for authenticated attackers, with...

PT-2026-79746

Name of the Vulnerable Software and Affected Versions WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels versions prior to 4.9.9 Description An issue exists in the get image src in base64 function that allows authenticated users with subscriber-level access or...

WordPress Membership For WooCommerce plugin < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass vulnerability

Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Membership For WooCommerce versions 3.1.2...

CVE-2026-77264 Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

CVE-2026-77264 Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order vulnerability

Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order vulnerability discovered by Shivamani Vastrala in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.20...

WordPress Cancel Order & Request Woocommerce plugin < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability

Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Cancel order request WooCommerce versions 1.3.4.34...