Description

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-08T08:17:10.923Z",
  "pubdate": "2026-09-08T08:17:10.923Z",
  "executiveSummary": "This vulnerability, classified as an Allocation of Resources Without Limits or Throttling issue, affects the WooCommerce plugin for WordPress. The flaw permits remote attackers to trigger a Denial of Service (DoS) condition by exhausting server resources through unrestricted HTTP requests.\nThe vulnerability exists in all WooCommerce versions prior to 11.1.0. An unauthenticated attacker can leverage this weakness to flood the application with specifically crafted or high-volume requests that the server fails to throttle or cap. This leads to the consumption of CPU, memory, or database connections, effectively rendering the site unresponsive to legitimate users.\nThe risk implication is high, as the exploit does not require administrative privileges or complex authentication, allowing for trivial exploitation over the network. Organizations running affected versions are exposed to potential service outages, which can impact revenue, operational continuity, and brand reputation. Immediate patching is advised to enforce proper request limiting and resource management controls.",
  "technicalDetails": "The root cause of this vulnerability lies in the absence of robust rate limiting or resource consumption constraints within the request-handling logic of the WooCommerce plugin. By failing to implement adequate throttling mechanisms, the application allows incoming HTTP requests to trigger expensive operations—such as complex database queries, remote API calls, or resource-heavy background processes—without verifying the frequency or volume of these requests per client IP or session.\nExploitation occurs when an attacker initiates a series of HTTP requests designed to maximize the target's resource consumption. Because there are no effective limits, the server allocates processing power and memory to each incoming request until the available system capacity is reached or depleted. This process effectively starves other legitimate application services of the necessary resources, resulting in application-layer DoS.\nThe attack flow typically involves the following steps: 1) Identification of an endpoint or request type within the WooCommerce ecosystem that demands significant server-side processing. 2) The attacker scripts a high-frequency request flood targeting this specific endpoint. 3) The target application attempts to fulfill every request simultaneously, bypassing standard request flow control. 4) The server's resource pool (CPU cores, PHP-FPM workers, or database connection threads) becomes saturated. 5) Subsequent legitimate user requests are dropped, timed out, or queued indefinitely, confirming a successful DoS state.\nThis vulnerability is particularly impactful because it does not depend on complex vulnerability chaining. The lack of input validation regarding request volume at the plugin level allows for exploitation directly via standard HTTP/HTTPS protocols. The flaw persists across affected versions, specifically encompassing any release prior to 11.1.0, and exposes the underlying WordPress environment to performance degradation. Post-exploitation, the attacker maintains control over the availability of the storefront, which can be leveraged for sustained service disruption or as a precursor to more sophisticated attacks that require a degraded server state."
}