WordPress Plugin Vulnerabilities

Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment

Description

The plugin does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products.

Proof of Concept

Affects Plugins

Plugin icon
profit-products-tables-for-woocommerce
Fixed in 2.1.3

References

CVE
CVE-2026-91009

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
JunHee CHO
Submitter
JunHee CHO
Submitter website
https://github.com/jun2e0
Verified
Yes
WPVDB ID
9a45333a-2db3-4695-9b1d-3677d31288f0

Timeline

Publicly Published
2026-09-15 (about 2 days ago)
Added
2026-09-15 (about 1 day ago)
Last Updated
2026-09-15 (about 1 day ago)

Other

Published
Title
Published
2026-03-01
Title
ShopWP <= 5.2.4 - Missing Authorization
Published
2025-12-22
Title
Premium Addons for Elementor < 4.11.54 - Unauthenticated Sensitive Information Exposure
Published
2025-09-22
Title
Classic Widgets with Block-based Widgets <= 1.0.1 - Missing Authorization
Published
2026-01-14
Title
Universal Google Adsense and Ads manager <= 1.1.8 - Missing Authorization
Published
2026-07-01
Title
Classified Listing – AI-Powered Classified ads & Business Directory < 5.4.3 - Missing Authorization