CVE-2026-86785
Received Received - Intake

Unauthenticated Configuration Update in Social Commerce for WooCommerce

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-86785
EUVD
EUVD-2026-85019

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
woocommerce social_commerce 2.5.4
woocommerce social_commerce to 2.5.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Social Commerce for WooCommerce WordPress plugin versions up to 2.5.4. It involves missing authorization checks in certain REST API endpoints, allowing unauthenticated users to modify plugin settings and product synchronization status without proper authentication.

Detection Guidance

Check if the Social Commerce for WooCommerce plugin version is 2.5.4 or lower. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the installed version.

Impact Analysis

An attacker could exploit this to change plugin configurations or disrupt product synchronization, potentially leading to unauthorized modifications, data inconsistencies, or service disruptions on affected WordPress sites.

Mitigation Strategies

Immediately update the Social Commerce for WooCommerce plugin to the latest version if available. If no update is available, consider disabling the plugin until a patch is released. Monitor plugin vendor announcements for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86785. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart