CVE-2026-87829: Authorization Bypass Through User-Controlled Key

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

PT-2026-94187

Name of the Vulnerable Software and Affected Versions Robokassa payment gateway for Woocommerce WordPress plugin versions prior to 1.8.9 Description The plugin fails to verify the authenticity of incoming payment notifications when the non-default deferred-payment feature is enabled. This allows...

CVE-2026-91009: Cross-Site Request Forgery (CSRF)

The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...

PT-2026-94176

Name of the Vulnerable Software and Affected Versions Active Woot Products Tables for WooCommerce versions prior to 2.1.3 Description Certain AJAX actions in the plugin lack authorization and Cross-Site Request Forgery CSRF checks. This allows any authenticated user, including those with subscrib...

PT-2026-94182

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.6.0 Description Insufficient access restrictions in the payment gateway configuration allow users with Contributor-level permissions or higher to view sensitive credentials. This includ...

PT-2026-94175

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.3.8 Description The plugin fails to perform ownership or authorization checks before rendering booking confirmation details. This allows unauthenticated attackers to retrieve personal...

PT-2026-94193

Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...

PT-2026-94277

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

PT-2026-94192

Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...

CVE-2026-91008: Authorization Bypass Through User-Controlled Key

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

WordPress Ni WooCommerce Sales Report plugin < 4.2.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Ni WooCommerce Sales Report versions 4.2.0...

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

CVE-2026-87860

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

CVE-2026-78472

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-78474

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin, in versions before 2.0.3 , is vulnerable to an unauthenticated subscription data disclosure . The root cause is an insufficient validation of the shared secret protecting one of its REST endpoints . This flaw allows unauthorized users to retriev...

WordPress Subscriptions for WooCommerce plugin < 2.0.3 - Unauthenticated Subscription Data Disclosure vulnerability

Unauthenticated Subscription Data Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Subscriptions for WooCommerce versions 2.0.3...

CVE-2026-87860 Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

CVE-2026-87860

The Subscriptions for WooCommerce WordPress plugin, in versions before 2.0.3 , is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause is the failure to verify a security token on requests used to cancel a subscription. This allows an attacker to trick a logged-in customer into ...