PT-2026-23668 · WordPress · Woocommerce

Oolongeya · Published 2026-03-06 · Updated 2026-03-30 · CVE-2026-3589

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WooCommerce versions 5.4.0 through 10.5.2

Description The WooCommerce WordPress plugin does not properly handle batch requests, potentially allowing unauthenticated users to execute administrative actions on non-store REST endpoints. This could enable the creation of arbitrary administrator users through a Cross-Site Request Forgery (CSRF) attack.

Recommendations Update WooCommerce to a version later than 10.5.2.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-3589

Affected Products

Woocommerce

References · 10

• 🔥 https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3589 · Security Note
• https://twitter.com/cyberbivash/status/2029899331134771272 · Twitter Post
• https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4 · Note
• https://twitter.com/TheyamLolzz/status/2037487278205911221 · Twitter Post
• https://twitter.com/CVEnew/status/2029975538346119674 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2038625248791109680 · Twitter Post
• https://t.me/CVEtracker/46586 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029876459892789355 · Twitter Post
• https://twitter.com/cracbot/status/2031686881252196423 · Twitter Post