Authorization Flaws in Active Woot Products Tables for WooCommerce Plugin
CVE-2026-91009
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 September 2026
Badges
What is CVE-2026-91009?
The Active Woot Products Tables plugin for WooCommerce, available for free on WordPress, has critical weaknesses in its AJAX action handling. Specifically, it lacks adequate authorization and CSRF protections, permitting any authenticated user—including those with subscriber privileges—to modify the titles of posts, pages, and products within the system. This oversight can lead to unauthorized content alterations, compromising the integrity of the website and potentially damaging the brand's reputation.
Affected Version(s)
Active Woot Products Tables for WooCommerce. 100% FREE 2.1.2 < 2.1.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.