Woocommerce vulnerabilities, page 3
89 vulnerabilities
Known vulnerabilities in Woocommerce products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 48 products.
CVE-2026-9284woocommercewoocommerce paypal payments+1
EPSS score0.56%
The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on the `ppc-create-order` and `ppc-get-order` WC-AJAX endpoints in all versions up to, and including, 4.0.1. The `ppc-create-order` endpoint accepts an arbitrary WooCommerce order ID in the `pay-now` context without validating order ownership, allowing attackers to create PayPal orders for any WC order and write PayPal metadata to it. The `ppc-get-order` endpoint returns full PayPal order details for any PayPal order ID without binding to the requester's session. This makes it possible for unauthenticated attackers to chain these endpoints to manipulate other customers' order payment flows and exfiltrate sensitive order details (payer information, shipping data) by creating a PayPal order for a victim's WC order and then retrieving the PayPal order data.CVE-2023-2179unknownwoocommerce order status change notifier+2EPSS score0.34%
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for exampleCVE-2023-52222automatticwoocommerce+2EPSS score0.29%
Cross-Site Request Forgery (CSRF) vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2.CVE-2023-51496woowoocommerce warranty requests+2EPSS score0.31%
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.CVE-2023-51497woowoocommerce ship to multiple addresses+2EPSS score0.31%
Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.9.CVE-2023-51494woowoocommerce product vendors+2EPSS score0.36%
Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.1.CVE-2023-51495woowoocommerce warranty requests+2EPSS score0.36%
Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7.CVE-2023-51502automatticwoocommerce_stripe+2EPSS score0.60%
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1.CVE-2023-51499woocommercewoocommerce shipping per product+1EPSS score0.39%
Missing Authorization vulnerability in WooCommerce WooCommerce Shipping Per Product.This issue affects WooCommerce Shipping Per Product: from n/a through 2.5.4.CVE-2023-47787automatticwoocommerce_bookings+2EPSS score0.26%
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 2.0.3.CVE-2023-47789automatticcanada_post_shipping_method+2EPSS score0.26%
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3.CVE-2023-36511woocommercewoocommerce_order_barcodes+1EPSS score0.26%
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Order Barcodes plugin <= 1.6.4 versions.CVE-2023-36513woocommerceautomatewoo+1EPSS score0.25%
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.5 versions.CVE-2023-36514woocommerceshipping_multiple_addresses+1EPSS score0.31%
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.CVE-2023-37873woocommerceshipping_multiple_addresses+1EPSS score0.38%
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.CVE-2023-37871automatticwoocommerce_gocardless+2EPSS score0.65%
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.CVE-2023-44999woocommercestripe_payment_gateway+2EPSS score0.22%
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.0.CVE-2023-32794woocommerceproduct add-ons+2EPSS score0.30%
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Add-Ons plugin <= 6.1.3 versions.CVE-2023-32743woocommerceautomatewoo+1EPSS score0.61%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.1.CVE-2023-32744woocommerceproduct_recommendations+1EPSS score0.30%
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Recommendations plugin <= 2.3.0 versions.