WordPress Plugin Vulnerabilities

Smart Manager < 8.86.0 - Contributor+ Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation, making it possible for authenticated attackers with Contributor-level access and above to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
smart-manager-for-wp-e-commerce
Fixed in 8.86.0

References

CVE
CVE-2026-45216
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/17f411fb-364c-4652-a277-bdfee36325f5

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.2 (High)

Miscellaneous

Original Researcher
Nguyen Ba Khanh
Verified
No
WPVDB ID
d17d4482-9dc1-4e0c-91e6-f59e54c19fd8

Timeline

Publicly Published
2026-05-12 (about 3 months ago)
Added
2026-05-20 (about 3 months ago)
Last Updated
2026-05-20 (about 3 months ago)

Other

Published
Title
Published
2026-05-28
Title
AI Engine – The Chatbot, AI Framework & MCP for WordPress < 3.5.0 - Editor+ Privilege Escalation
Published
2026-07-10
Title
Simple JWT Login < 3.6.7 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation via 'payload' Parameter
Published
2025-10-06
Title
Sonaar < 4.27.5 - Subscriber+ Privilege Escalation
Published
2025-01-14
Title
User Management <= 1.2 - Authenticated (Subscriber+) Privilege Escalation
Published
2026-06-16
Title
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery < 3.9.5 - Authenticated (Subscriber+) Privilege Escalation