What’s Vulnerable › Vulnerabilities

CVE-2026-86785: Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-23 · updated 2026-09-23
• Weakness: CWE-862

Description

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.

Affected products

• Social Commerce for WooCommerce: through 2.5.4

References

• https://wpscan.com/vulnerability/9a4c36bd-c7f7-4068-ac73-b29ee66def96/

Get alerted when CVE-2026-86785 or the next vulnerability affects your stack