User Authentication Bypass in Blacklist Manager for WooCommerce Plugin
CVE-2026-88828

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Blacklist Manager
Vendor
CVE Published:
28 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-88828?

The Blacklist Manager for WooCommerce plugin allows users whose accounts are supposed to be blocked to bypass these restrictions through various authentication methods. This flaw means that previously blocked users can still gain access with their existing privileges, thereby undermining the intended security measures of the plugin. Users should take immediate action to update to a patched version and review authentication policies to safeguard against unauthorized access.

Affected Version(s)

Blacklist Manager 1.3.0 < 2.3.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-88828 - Proof of Concept

References

https://wpscan.com/vulnerability/52804421-8988-4d8a-9143-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Naoki Kawahigashi
WPScan
.