CVE-2026-86850
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: WPScan

Description
The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-19
AI Q&A
2026-10-09
EPSS Evaluated
2026-10-18
NVD
CVE-2026-86850
EUVD
EUVD-2026-95503

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown SKU Error Fixer for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the SKU Error Fixer for WooCommerce plugin allows unauthenticated users to perform two unauthorized AJAX actions. These actions can permanently delete product variations marked as obsolete and expose their details without any recoverable copy left behind. The issue occurs because the plugin does not check user capabilities or nonces before executing these actions.

Detection Guidance

Check if the SKU Error Fixer for WooCommerce plugin version 1.0 or below is installed on your WordPress site. Review server logs for unauthorized AJAX requests to actions related to product variation deletion or disclosure.

Impact Analysis

This vulnerability can lead to permanent data loss for product variations in WooCommerce stores. Unauthenticated attackers could delete critical product data and access sensitive details, disrupting business operations and causing financial harm. There is no way to recover deleted data.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by exposing or deleting sensitive product data, leading to unauthorized access or loss of personal and health-related information. Compliance failures may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately uninstall or disable the SKU Error Fixer for WooCommerce plugin version 1.0 or below. Monitor for any suspicious activity related to product variations. Check for missing or altered product data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart