Description

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitrary posts, via IDOR.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T06:17:19.380Z",
  "pubdate": "2026-09-02T06:17:19.380Z",
  "executiveSummary": "The WC Vendors WordPress plugin, specifically in versions prior to 2.7.2.1, contains an Insecure Direct Object Reference (IDOR) vulnerability. This security flaw stems from the plugin's failure to perform adequate authorization checks on user-supplied identifiers during product variation modification processes.\nThe vulnerability allows an authenticated attacker possessing the 'vendor' role to bypass intended access controls. By manipulating product variation IDs, a malicious actor can modify data belonging to other vendors, or manipulate arbitrary posts, including altering their titles and statuses.\nThis vulnerability poses a significant risk to the integrity of the e-commerce platform's data. Attackers can leverage this flaw to sabotage rival vendor storefronts, engage in unauthorized content modification, or potentially disrupt site operations by modifying administrative or system posts. Exploitation requires the attacker to be authenticated as a vendor, but requires no further privilege elevation beyond the base vendor role. The vulnerability is categorized as a failure in access control, emphasizing the critical need for proper ownership verification on all server-side object operations.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of access control checks within the product variation update functionality of the WC Vendors plugin. When the system processes requests to save or update product variations, it fails to validate whether the current authenticated user owns the object associated with the provided ID. Furthermore, the application fails to verify the object type before initiating modification, leading to an overly permissive authorization model.\nThe vulnerability is characterized as an Insecure Direct Object Reference (IDOR). In the context of this plugin, the application takes a user-supplied ID parameter representing a product variation or post and directly interacts with the database or relevant WordPress APIs to perform updates without cross-referencing the object's ownership against the current user's session context.\nAn attack flow typically begins with an authenticated user identifying a target product variation ID or an arbitrary post ID, potentially through reconnaissance of the site's REST API, frontend source code, or internal application logic. The attacker then constructs a crafted POST request targeting the plugin's handling endpoint. By substituting the valid, owned variation ID with the ID of a victim's variation or a restricted post, the attacker sends the request to the server.\nUpon receiving the request, the server-side code, lacking sufficient validation, proceeds to execute the update operation using the malicious ID. This results in the modification of the specified post's title, status, or the variation's configuration, even though the authenticated user possesses no legitimate permissions to interact with that specific object.\nThis vulnerability is restricted to authenticated users holding the 'vendor' role. However, because vendors often operate on a multi-tenant model where they should only control their own products, this flaw effectively breaks the boundary between different tenants. The potential impact is severe, encompassing data corruption, unauthorized information manipulation, and the potential disruption of platform-wide data integrity.\nThe vulnerable code component is responsible for processing save or update requests for product variations. As the plugin does not verify object ownership or object type, it inadvertently exposes an interface for unauthorized administrative modifications across the WordPress instance."
}