CVE-2024-1310Medium· 4.9▾ SunlitThe WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
0.7% → 0.7%
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
woocommerce < 8.6.0Upgrade past the affected range:
woocommerce 8.6.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106608High· 7.2Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.
CVE-2026-48888High· 7.5Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.
CVE-2026-112329Medium· 4.3Sensei LMS 4.26.4 Broken Access Control via save_new_message
CVE-2026-112328Medium· 4.3Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
CVE-2026-40808Medium· 6.5Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
CVE-2026-106602Medium· 4.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.