HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-95687 — The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to...

·Source: NIST NVD

Updated:

Executive Summary

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing an authenticated attacker to log in as any WordPress Administrator by directly supplying an Administrato

Analysis

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing an authenticated attacker to log in as any WordPress Administrator by directly supplying an Administrator's user ID to the wpcsa_login endpoint and receiving a full Administrator session cookie without supplying the Administrator's password. This makes it possible for authenticated attackers to perform a direct session takeover, gaining full Administrator-level access to the site. CVSS Score: 8.8. Published: 2026-10-01T09:17:10.273.

Indicators of Compromise (1)

CVE (1)
CVE-2026-95687
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 1, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-104611 — A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown fu...

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVE-2026-104611
NIST NVD
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-104610 — A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_...

A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-104610
NIST NVD
MEDIUMVulnerability

Malicious Linux Implants Mimic Asian Mail Security Products

A trio of newly discovered backdoors walk and quack like legitimate edge solutions, so it's hard to tell they're not.

Dark Reading