CVE-2026-118072
Received Received - Intake

Unauthorized Order Blacklist Addition in Fraud Prevention For WooCommerce and EDD

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: WPScan

Description
The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118072
EUVD
EUVD-2026-113729

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Fraud Prevention For WooCommerce and EDD 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Fraud Prevention For WooCommerce and EDD WordPress plugin before version 2.3.6. It allows users with the Subscriber role or higher to add any customer's details to a fraud blacklist without proper authorization checks. This could block legitimate customers from placing orders.

Detection Guidance

Check the installed version of the Fraud Prevention For WooCommerce and EDD plugin. If it is below 2.3.6, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker with minimal privileges could prevent legitimate customers from placing orders by blacklisting them. This disrupts business operations and may lead to loss of revenue or customer trust.

Compliance Impact

This vulnerability could lead to unauthorized access controls, potentially violating GDPR's data protection principles or HIPAA's access safeguards by allowing unauthorized users to manipulate customer data.

Mitigation Strategies

Update the Fraud Prevention For WooCommerce and EDD plugin to version 2.3.6 or later immediately to patch the vulnerability. Remove or disable the plugin if an update is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118072. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart