Unauthorized Data Modification Vulnerability in WooCommerce Plugin for WordPress

CVE-2026-11364

What is CVE-2026-11364?

The WooCommerce Product Specifications plugin for WordPress is susceptible to unauthorized data manipulation. This vulnerability arises from inadequate capability checks and missing nonce verification in the methods of the AttributeGroupController and AttributeController classes. As a result, authenticated users with Subscriber access or higher can potentially alter, create, or delete product specification groups and attributes. This can compromise the integrity of business data and disrupt the site's frontend presentation, posing a significant risk to online commerce.

References