CVE-2026-3589 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged…
High CVSS: 7.5

CVE-2026-3589

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
Vendor
-
Product
-
CWE
CWE-352
Yayın Tarihi
2026-03-06 10:16:22
Güncelleme
2026-03-09 13:35:34
Source Identifier
contact@wpscan.com
KEV Date Added
-

Kategoriler

CWE-352 HIGH 2026

Referanslar

https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/ https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/