Unauthenticated Access Control Flaw in WooCommerce Thank You Page Customizer Plugin
CVE-2026-81786

7.5HIGH

Key Information:

Vendor

WordPress
Status
Thank You Page Customizer For WooCommerce
Vendor
CVE Published:
10 September 2026

What is CVE-2026-81786?

The Thank You Page Customizer for WooCommerce plugin versions up to 1.2.2 is affected by an unauthenticated broken access control vulnerability. This flaw allows attackers to potentially manipulate access to user data or resources that should be protected, as there are inadequate restrictions placed on certain operations within the plugin. Therefore, it is crucial for users of this plugin to update to the latest version and ensure proper security measures are in place to safeguard their WooCommerce environments.

Affected Version(s)

Thank You Page Customizer for WooCommerce <= 1.2.2

References

https://patchstack.com/database/wordpress/plugin/woo-than...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tony Harris | Patchstack Bug Bounty Program
.