Productive Commerce WordPress Plugin Lacks Capability Check
CVE-2026-109926
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 21 October 2026
Badges
What is CVE-2026-109926?
The Productive Commerce WordPress plugin prior to version 1.1.49 is affected by a vulnerability that allows unauthorized access to certain administrative functions. This occurs because the plugin fails to adequately verify user capabilities during specific AJAX actions, exposing a nonce associated with those actions on every admin page. As a result, any authenticated user, even those with low-level permissions such as subscribers, can trigger actions that could manipulate or activate features of the Productive Commerce plugin without appropriate authorization, potentially leading to compromise or misuse of site functionality.
Affected Version(s)
Productive Commerce 0 < 1.1.49
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.