Access Control Flaw in WooCommerce Bulk Edit Products by Jose Vega
CVE-2026-61952

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
WooCommerce Bulk Edit Products – WP Sheet Editor
Vendor
CVE Published:
13 July 2026

What is CVE-2026-61952?

A missing authorization vulnerability has been identified in the WooCommerce Bulk Edit Products plugin by Jose Vega. This flaw allows attackers to exploit incorrectly configured access levels, potentially enabling unauthorized actions on products. The issue affects versions from an unspecified version up to and including 1.8.21. Site administrators should ensure that proper access control measures are in place to mitigate the risk of this vulnerability.

Affected Version(s)

WooCommerce Bulk Edit Products – WP Sheet Editor 0 <= 1.8.21

References

https://patchstack.com/database/Wordpress/Plugin/woo-bulk...
vdb-entry

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack)
.