What’s Vulnerable › Vulnerabilities
CVE-2026-88828: Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-28 · updated 2026-09-28
- Weakness: CWE-288
Description
The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.
Affected products
- Blacklist Manager: from 1.3.0 before 2.3.2 — fixed in 2.3.2
How to fix
Upgrade to a fixed version: Blacklist Manager 2.3.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-88828 or the next vulnerability affects your stack