← WordPress Vulnerabilities
WordPress security by component

WPify Woo

WPify Woo is a WordPress component with 3 published CVE records in this archive. The latest tracked vulnerability was published Jul 24, 2026; the highest CVE/CNA score is 9.9.

Plugin slug: wpify-woo

CVE-2026-12736: WPify Woo lets Shop Managers overwrite arbitrary WordPress options

WPify Woo through 5.4.16 grants its POST /wp-json/wpify-woo/v1/option route to users with manage_woocommerce. SettingsApi::save_option() passes the request-controlled option, data and optional autoload values directly to update_option() without an option-name allowlist. A Shop Manager can therefore change security-sensitive core options, enable administrator registration or disable security plugins and escalate privileges.

PublishedJul 24, 2026
Known safe version5.4.17
Safe version
Jul 24, 2026 CVE-2026-12736
WPify Woo lets Shop Managers overwrite arbitrary WordPress options
WPify Woo through 5.4.16 grants its POST /wp-json/wpify-woo/v1/option route to users with manage_woocommerce. SettingsApi::save_option() passes the request-controlled option, data and optional autoload values directly to update_option() without an option-name allowlist. A Shop Manager can therefore change security-sensitive core options, enable administrator registration or disable security plugins and escalate privileges.
5.4.17
CVE8.0
NVDPending
May 27, 2026 CVE-2026-42748
WPify Woo Czech: Dangerous file upload
WPify Woo Czech is affected by dangerous file upload. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise. The published affected range is <= 5.4.1.
5.4.2
CVE9.9
NVDPending
May 03, 2024 CVE-2024-33946
WPify Woo Czech: Cross-site scripting
WPify Woo Czech is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE7.1
NVDPending