Unauthenticated API Access in Social Commerce for WooCommerce Plugin by WordPress
CVE-2026-86785

Currently unrated

Key Information:

Vendor

WordPress
Status
Social Commerce For WooCommerce
Vendor
CVE Published:
23 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-86785?

The Social Commerce for WooCommerce plugin for WordPress, specifically version 2.5.4, lacks proper authorization checks on certain REST API endpoints. This security oversight permits unauthenticated users to manipulate the plugin's configuration settings and alter product synchronization states, potentially leading to unauthorized alterations in the e-commerce environment.

Affected Version(s)

Social Commerce for WooCommerce 0 <= 2.5.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-86785 - Proof of Concept

References

https://wpscan.com/vulnerability/9a4c36bd-c7f7-4068-ac73-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • đź‘ľ

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pablo González
Fran Ramirez and Iñigo Sánchez
WPScan
.