WordPress Plugin Vulnerabilities

WooCommerce < 11.1.0 - Unauthenticated DoS

Description

The plugin is vulnerable to Denial of Service due to insufficient validation of user supplied input. This makes it possible for unauthenticated attackers to make the affected site unavailable.

Affects Plugins

Plugin icon
woocommerce
Fixed in 11.1.0

References

CVE
CVE-2026-48888
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/22652d78-577c-4467-9b6e-55811ebf6412

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
6e0eb3d6-4571-4e99-b201-dd8527c67de2

Timeline

Publicly Published
2026-09-07 (about 29 days ago)
Added
2026-09-10 (about 25 days ago)
Last Updated
2026-09-10 (about 25 days ago)

Other

Published
Title
Published
2022-12-09
Title
Authenticator < 1.3.1 - Subscriber+ Denial of Service via Feed Token Disclosure
Published
2026-09-14
Title
Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update
Published
2021-12-06
Title
Stars Rating < 3.5.1 - Comments Denial of Service
Published
2021-04-27
Title
WPGraphQL < 1.3.6 - Denial of Service
Published
2024-02-08
Title
Backuply - Backup, Restore, Migrate and Clone < 1.2.6 - Unauthenticated Denial of Service