WC Vendors permits cross-vendor product and post modification
WC Vendors before 2.7.2.1 does not verify ownership or object type when saving user-supplied product-variation IDs. An authenticated vendor can modify another vendor's variations and can change the status and title of arbitrary posts.
- Component
- WC Vendors
- Plugin slug
wc-vendors- Affected
- < 2.7.2.1
- Safe version
2.7.2.1- Published
- Sep 02, 2026
This CVE was published Sep 02, 2026 and is one of 8 known issues for this plugin.
Update, patch or deactivate.
Update to WC Vendors 2.7.2.1 or later and audit variation, post-title, and post-status changes made by vendor accounts.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N