CVE-2026-118072
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
61/100
Published: 2026-10-30
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
Low
A:
Low
Description
The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Unknown | Fraud Prevention For WooCommerce and EDD | 0 < 2.3.6 |
| Unknown | Fraud Prevention For WooCommerce and EDD | 0 < 2.3.6 |