CVE-2026-12736
Received Received - Intake

Privilege Escalation in Wpify Woo WordPress Plugin

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Wordfence

Description
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-12736
EUVD
EUVD-2026-48465

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpify woo to 5.4.16 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Wpify Woo WordPress plugin up to version 5.4.16 has a privilege escalation vulnerability. The plugin's REST API endpoint POST /wp-json/wpify-woo/v1/option allows authenticated users with Shop Manager access or higher to modify WordPress options without proper restrictions. The endpoint passes user-supplied 'option' and 'data' parameters directly to update_option() without validation or sanitization. Attackers can exploit this to change critical settings like default user roles to administrator or enable user registration, effectively gaining full control of the WordPress site.

Detection Guidance

Check for unauthorized privilege changes in WordPress user roles or settings modifications via the vulnerable REST route. Inspect logs for POST requests to /wp-json/wpify-woo/v1/option with suspicious option values like default_role or users_can_register.

Impact Analysis

If you use the vulnerable Wpify Woo plugin, an attacker with Shop Manager-level access could escalate their privileges to Administrator. This would allow them to take full control of your WordPress site, install malicious plugins, modify content, steal data, or disable security measures. The attack requires only authenticated access at the Shop Manager level, which may be obtained through other vulnerabilities or weak credentials.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to personal and sensitive data. If attackers gain Administrator access, they could exfiltrate user data, disable logging, or modify security settings, violating data protection requirements. Organizations using this plugin may face regulatory penalties, loss of trust, and legal consequences due to compromised data integrity and confidentiality.

Mitigation Strategies

Update the Wpify Woo plugin to the latest version if available. Remove or restrict access to the /wp-json/wpify-woo/v1/option REST route. Review WordPress user roles for unauthorized changes and disable the Shop Manager role if not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12736. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart