---
id: CVE-2026-118072
title: >-
  Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary
  Customer Blacklisting
summary: >-
  The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6
  does not check that a user is allowed to manage orders before letting them add
  an order's customer details to the store's fraud blacklist, which could allow
  users…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cvssSource: adp
cwe:
  - CWE-862
product: Fraud Prevention For WooCommerce and EDD
affected:
  - fraud_prevention_for_woocommerce_and_edd < 2.3.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T13:16:51.220168Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T13:26:46.841Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118072'
references:
  - url: 'https://wpscan.com/vulnerability/3bb95ff2-b7b6-438f-9a92-9533975579af/'
tags:
  - cve.org
epss: 0.0017
epssPercentile: 0.06383
ingestedAt: '2026-11-05T16:07:30.262Z'
---

## Overview

The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.

## Affected

- `fraud_prevention_for_woocommerce_and_edd < 2.3.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.