CVE-2026-32586
Received Received - Intake
Missing Authorization in Booster for WooCommerce Enables Unauthorized Access

Publication date: 2026-03-17

Last updated on: 2026-04-29

Assigner: Patchstack

Description
Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a through < 7.11.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-17
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-03-17
EPSS Evaluated
2026-06-15
NVD
CVE-2026-32586
EUVD
EUVD-2026-12550
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
booster_for_woocommerce booster_for_woocommerce to 7.11.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

I don't know

Executive Summary

CVE-2026-32586 is a Broken Access Control vulnerability in the WordPress Booster for WooCommerce Plugin versions prior to 7.11.3. It occurs due to missing authorization, authentication, or nonce token checks within certain plugin functions.

This flaw allows unauthenticated users to perform actions that normally require higher privileges, meaning attackers can exploit the plugin without logging in.

The vulnerability is categorized under the OWASP Top 10 as A1: Broken Access Control.

Impact Analysis

This vulnerability allows attackers to perform unauthorized actions on affected websites without authentication.

Although the CVSS severity score is 5.3, indicating a low priority threat with limited impact, such vulnerabilities are often exploited in mass campaigns targeting many websites indiscriminately.

The impact mainly involves potential unauthorized changes or disruptions to the WooCommerce plugin functionality, which could affect website operations.

Detection Guidance

This vulnerability arises from missing authorization, authentication, or nonce token checks within certain plugin functions, allowing unauthenticated users to perform privileged actions.

There is no specific detection command or network signature provided in the available resources.

Mitigation Strategies

The recommended immediate mitigation is to update the Booster for WooCommerce plugin to version 7.11.3 or later, which contains the patch resolving this issue.

Additionally, enabling auto-updates for vulnerable plugins can ensure rapid protection against this and similar vulnerabilities.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart