WordPress Plugin Vulnerabilities

License Manager for WooCommerce < 3.0.18 - Authenticated (Customer+) Arbitrary Content Deletion

Description

The License Manager for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in all versions up to, and including, 3.0.17. This makes it possible for authenticated attackers, with Custom-level access and above, to delete arbitrary content.

Affects Plugins

Plugin icon
license-manager-for-woocommerce
Fixed in 3.0.18

References

CVE
CVE-2026-61958
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6bceb15e-0727-4bd5-b4e7-f2c1f2f3ef51

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
WiniS
Verified
No
WPVDB ID
e4338e97-fcd3-4258-99ce-d2b6670dba0f

Timeline

Publicly Published
2026-07-21 (about 2 months ago)
Added
2026-07-29 (about 2 months ago)
Last Updated
2026-07-29 (about 2 months ago)

Other

Published
Title
Published
2023-12-27
Title
Doofinder for WooCommerce < 2.1.1 - Missing Authorization via multiple AJAX actions
Published
2026-07-09
Title
Easy Appointments < 3.12.28 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation
Published
2022-01-31
Title
Use Any Font < 6.2.1 - Unauthenticated Arbitrary CSS Appending
Published
2024-07-19
Title
WooCommerce - Social Login < 2.7.4 - Missing Authorization to Unauthenticated Privilege Escalation
Published
2026-01-16
Title
Client Portal – Private user pages and login < 1.2.2 - Missing Authorization