Description

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T17:17:29.883Z",
  "pubdate": "2026-09-03T17:17:29.883Z",
  "executiveSummary": "The Pre-Orders for WooCommerce plugin, in versions 2.3 and below, is susceptible to an unauthenticated bypass vulnerability. This flaw allows unauthorized actors to circumvent established pre-order restrictions or access restricted checkout functionalities without proper validation.\nCategorized as an access control bypass, this vulnerability poses a significant risk to e-commerce integrity by potentially allowing unauthorized users to manipulate the order fulfillment process, bypass inventory gating, or secure items intended for restricted access.\nThe vulnerability is accessible to unauthenticated remote attackers who do not possess valid administrative or customer privileges. Exploitation does not require prior knowledge of the target system's backend configuration, as the flaw lies in the insecure handling of request parameters that govern pre-order status and availability checks.\nThe primary risk implication involves the unauthorized creation of orders or the bypassing of payment and shipping constraints defined by the site administrator. Organizations utilizing this plugin are at risk of business logic abuse, leading to potential inventory discrepancies and financial irregularities. Remediation requires an immediate update to the latest patched version of the plugin to enforce necessary access control checks on all order-related request handlers.",
  "technicalDetails": "The vulnerability resides within the plugin's core request processing logic, specifically where the state of a pre-order is verified before allowing a product to be added to the cart or proceeded through the checkout process. In versions 2.3 and below, the plugin fails to perform rigorous server-side validation of the pre-order status when handling specific HTTP requests directed at the product or checkout endpoints.\nThe root cause is an insecure implementation of access control checks, where the plugin relies on client-side input or fails to verify the authenticated state of the requester before applying pre-order business logic. When a product is configured as a pre-order item, the system should strictly gate access based on the user's authentication status and the defined availability schedule. However, the affected versions permit an unauthenticated attacker to manipulate request parameters—typically via crafted POST or GET requests—to fool the application into treating a non-authorized session as a valid pre-order process.\nThe attack flow follows a predictable pattern: First, the attacker identifies a product endpoint managed by Pre-Orders for WooCommerce. By intercepting or manually crafting HTTP requests, the attacker injects or alters parameters responsible for triggering the pre-order logic. Because the server-side code does not validate whether the requesting session is authorized or if the global pre-order configuration is currently active for the target user, the application proceeds to execute functions that add the restricted item to the cart or finalize the pre-order transaction.\nThis bypass effectively renders the plugin's security layer non-functional for unauthenticated users, allowing them to interact with backend functions intended only for verified transactions. The lack of an authentication requirement means the vulnerability can be exploited by any remote attacker with network access to the target WooCommerce installation. The payload behavior does not involve traditional injection (such as SQLi or XSS), but rather a manipulation of the application's internal workflow. Post-exploitation, an attacker can successfully complete the checkout flow for products that should be inaccessible or subject to specific pre-order conditions, potentially causing significant administrative burden, revenue loss, or inventory mismanagement."
}