CVE-2026-32586

Received Received - Intake

Missing Authorization in Booster for WooCommerce Enables Unauthorized Access

Publication date: 2026-03-17

Last updated on: 2026-04-29

Assigner: Patchstack

Description

Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a through < 7.11.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-17

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-03-17

EPSS Evaluated

2026-07-05

NVD

CVE-2026-32586

EUVD

EUVD-2026-12550

Affected Vendors & Products

Vendor	Product	Version / Range
booster_for_woocommerce	booster_for_woocommerce	to 7.11.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Compliance Impact

I don't know

Executive Summary

CVE-2026-32586 is a Broken Access Control vulnerability in the WordPress Booster for WooCommerce Plugin versions prior to 7.11.3. It occurs due to missing authorization, authentication, or nonce token checks within certain plugin functions.

This flaw allows unauthenticated users to perform actions that normally require higher privileges, meaning attackers can exploit the plugin without logging in.

The vulnerability is categorized under the OWASP Top 10 as A1: Broken Access Control.

Impact Analysis

This vulnerability allows attackers to perform unauthorized actions on affected websites without authentication.

Although the CVSS severity score is 5.3, indicating a low priority threat with limited impact, such vulnerabilities are often exploited in mass campaigns targeting many websites indiscriminately.

The impact mainly involves potential unauthorized changes or disruptions to the WooCommerce plugin functionality, which could affect website operations.

Detection Guidance

This vulnerability arises from missing authorization, authentication, or nonce token checks within certain plugin functions, allowing unauthenticated users to perform privileged actions.

There is no specific detection command or network signature provided in the available resources.

Mitigation Strategies

The recommended immediate mitigation is to update the Booster for WooCommerce plugin to version 7.11.3 or later, which contains the patch resolving this issue.

Additionally, enabling auto-updates for vulnerable plugins can ensure rapid protection against this and similar vulnerabilities.

Hi! I’m here to help you understand CVE-2026-32586. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70