CVE-2026-3589 describes a critical vulnerability in the WooCommerce WordPress plugin, affecting versions 5.4.0 through 10.5.2. This flaw allows unauthenticated attackers to bypass security measures by exploiting improper handling of batch requests, enabling them to execute administrative actions and potentially create new administrator accounts through a Cross-Site Request Forgery (CSRF) attack. Rated with a CVSS score of 7.5 (High), the vulnerability has a network attack vector and high impact on confidentiality, integrity, and availability, though it requires high attack complexity and user interaction. The EPSS score is very low, suggesting a low probability of exploitation in the wild. Currently, there is no public exploit code available in Metasploit, Nuclei, or ExploitDB, and it is not listed in the CISA KEV catalog. Despite limited media coverage, the vulnerability has garnered some community discussion, indicating awareness among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 10.0.0, < 10.0.6CPE match | cpe:2.3:a:automattic:woocommerce:*:*:*:*:*:wordpress:*:* | ||
>= 10.1.0, < 10.1.4CPE match | cpe:2.3:a:automattic:woocommerce:*:*:*:*:*:wordpress:*:* | ||
>= 10.2.0, < 10.2.4CPE match | cpe:2.3:a:automattic:woocommerce:*:*:*:*:*:wordpress:*:* | ||
>= 10.3.0, < 10.3.8CPE match | cpe:2.3:a:automattic:woocommerce:*:*:*:*:*:wordpress:*:* | ||
>= 10.4.0, < 10.4.4CPE match | cpe:2.3:a:automattic:woocommerce:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.4 Bluesky, 0.2 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.6 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.