CVE-2026-61952
Received Received - Intake

BaseFortify

Publication date: 2026-07-13

Last updated on: 2026-07-13

Assigner: Patchstack

Description
Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Editor: from n/a through <= 1.8.21.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-13
Last Modified
2026-07-13
Generated
2026-07-13
AI Q&A
2026-07-13
EPSS Evaluated
N/A
NVD
CVE-2026-61952
EUVD
EUVD-2026-43433

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_sheet_editor woo_bulk_edit_products From 1.0.0 (inc) to 1.8.21 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Mitigation Strategies

To mitigate the vulnerability in WooCommerce Bulk Edit Products – WP Sheet Editor, you should update the plugin to version 1.8.22 or later, where the broken access control issue has been fixed.

If you are a Patchstack user, you can enable auto-updates for vulnerable plugins to ensure you receive patches promptly.

Impact Analysis

This vulnerability can allow users without proper permissions to perform higher-privileged actions within the WooCommerce Bulk Edit Products plugin.

Such unauthorized actions could lead to unauthorized modifications of product data or other administrative functions that should be restricted.

Although the impact is considered low severity (CVSS 4.9), it still poses a risk to the integrity of the product management process.

Executive Summary

CVE-2026-61952 is a Broken Access Control vulnerability in the WordPress plugin "WooCommerce Bulk Edit Products – WP Sheet Editor" version 1.8.21 or earlier.

This vulnerability occurs because of missing authorization, authentication, or nonce token checks, which allows unprivileged users to perform actions that should require higher privileges.

It is classified under OWASP Top 10 A1: Broken Access Control and has a CVSS score of 4.9, indicating a low severity impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61952. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart