Broken Access Control in Gratisfaction Plugin for WooCommerce
CVE-2026-97297

7.6HIGH

Key Information:

Vendor

WordPress
Status
Gratisfaction
Vendor
CVE Published:
1 October 2026

What is CVE-2026-97297?

The Gratisfaction plugin for WooCommerce, versions 4.6.3 and earlier, is affected by a broken access control vulnerability that potentially allows unauthorized subscribers to execute functions they should not have access to. This misconfiguration can lead to unauthorized actions by end users, thereby compromising the integrity of user data and functionalities within the application. Site administrators are advised to upgrade to the latest version to mitigate this risk and ensure their WooCommerce environment remains secure.

Affected Version(s)

Gratisfaction <= 4.6.3

References

https://patchstack.com/database/wordpress/plugin/gratisfa...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SecondGateWP | Patchstack Bug Bounty Program
.