CVE-2026-107863
5.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-862
Impact
Unauthenticated attackers can bypass access restrictions to alter WooCommerce product availability or user access levels remotely. They only need network access to the site's web interface.
Root cause
The plugin fails to perform authorization checks, allowing unprivileged requests to execute restricted functions.
Affected systems
Products Restricted Users for WooCommerce (woo-products-restricted-users) through version 0.7.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
Upgrade to a version higher than 0.7 once available. If a patch is unavailable, deactivate and remove the plugin immediately to eliminate the exposure.
$ wp plugin deactivate woo-products-restricted-usersAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.