What’s Vulnerable › Vulnerabilities
CVE-2026-91009: Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-17 · updated 2026-09-18
- Weakness: CWE-352
Description
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products.
Affected products
- Active Woot Products Tables for WooCommerce. 100% FREE: from 2.1.2 before 2.1.3 — fixed in 2.1.3
How to fix
Upgrade to a fixed version: Active Woot Products Tables for WooCommerce. 100% FREE 2.1.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-91009 or the next vulnerability affects your stack