CVE-2026-3589: The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a…

PriorityP343high7.5CVSS 3.1

AVNACHPRNUIRSUCHIHAH

EPSS

0.13%

2.6th percentile

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.

Affected

52 ranges· showing 25

Vendor	Product	Version range	Fixed in
automattic	woocommerce	>= 10.0.0 < 10.0.6	10.0.6
automattic	woocommerce	>= 10.1.0 < 10.1.4	10.1.4
automattic	woocommerce	>= 10.2.0 < 10.2.4	10.2.4
automattic	woocommerce	>= 10.3.0 < 10.3.8	10.3.8
automattic	woocommerce	>= 10.4.0 < 10.4.4	10.4.4
automattic	woocommerce	>= 10.5.0 < 10.5.3	10.5.3
automattic	woocommerce	>= 5.4.0 < 5.4.4	5.4.4
automattic	woocommerce	>= 5.5.0 < 5.4.5	5.4.5
automattic	woocommerce	>= 5.6.0 < 5.6.3	5.6.3
automattic	woocommerce	>= 5.7.0 < 5.7.3	5.7.3
automattic	woocommerce	>= 5.8.0 < 5.8.2	5.8.2
automattic	woocommerce	>= 5.9.0 < 5.9.2	5.9.2
automattic	woocommerce	>= 6.0.0 < 6.0.2	6.0.2
automattic	woocommerce	>= 6.1.0 < 6.1.3	6.1.3
automattic	woocommerce	>= 6.2.0 < 6.2.3	6.2.3
automattic	woocommerce	>= 6.3.0 < 6.3.2	6.3.2
automattic	woocommerce	>= 6.4.0 < 6.4.2	6.4.2
automattic	woocommerce	>= 6.5.0 < 6.5.2	6.5.2
automattic	woocommerce	>= 6.6.0 < 6.6.2	6.6.2
automattic	woocommerce	>= 6.7.0 < 6.7.1	6.7.1
automattic	woocommerce	>= 6.8.0 < 6.8.3	6.8.3
automattic	woocommerce	>= 6.9.0 < 6.9.5	6.9.5
automattic	woocommerce	>= 7.0.0 < 7.0.2	7.0.2
automattic	woocommerce	>= 7.1.0 < 7.1.2	7.1.2
automattic	woocommerce	>= 7.2.0 < 7.2.4	7.2.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.