Description

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary WooCommerce product metadata, including Empik logistic class (_empik_logistic_klass), product state (_empik_product_state, _empik_product_state_all_variants), and Empik export and offer flags on any product in the store.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-19T09:16:35.210Z",
  "pubdate": "2026-09-19T09:16:35.210Z",
  "executiveSummary": "The Empik for WooCommerce plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 1.5.1. The flaw stems from insufficient access control checks within the plugin's metadata update routines.\nThis vulnerability allows authenticated users with subscriber-level permissions or higher to perform unauthorized modifications to WooCommerce product metadata. By manipulating specific fields related to Empik integration, an attacker can influence critical product attributes, such as logistic classes, state identifiers, and export/offer flags, across the entire product catalog.\nThe risk implication is significant as it permits unauthorized influence over the store's logistics and inventory management processes, potentially disrupting supply chain operations or manipulating product visibility on the Empik platform. Exploitation requires minimal privileges (subscriber account), making it accessible to any registered user. There are no complex exploitation requirements; the attacker simply needs to interact with the vulnerable backend endpoints handling product metadata updates.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement robust authorization checks (e.g., proper capability validation via current_user_can() or nonce verification) within the functions responsible for processing product metadata updates. The plugin exposes internal administrative endpoints or AJAX actions to users who possess 'subscriber' privileges, despite the actions being intended solely for store managers or administrators.\nThe attack flow begins when an authenticated subscriber sends a crafted request to the vulnerable endpoint. Because the plugin lacks a validation layer to verify if the requesting user has the 'manage_woocommerce' or equivalent capability, the backend service proceeds to process the request as if it originated from a privileged administrator.\nUpon receiving the malicious request, the backend function accepts arbitrary input parameters mapped to WooCommerce product metadata fields. An attacker can specifically target fields such as '_empik_logistic_klass', '_empik_product_state', '_empik_product_state_all_variants', and various Empik-specific export and offer flags. By iterating through product IDs, an attacker can perform a bulk update or targeted modification of product metadata on any product in the store database.\nThe exploit effectively bypasses the intended security boundary of the WordPress user role system. The post-exploitation impact includes the potential to corrupt the integration between the WooCommerce store and the Empik marketplace. By modifying logistic classes, an attacker could force incorrect shipping settings; by altering product state flags, they could inadvertently disable product exports or misrepresent the offer status of goods on the Empik platform. Furthermore, the ability to modify these fields provides an attacker with a vector to disrupt business logic or perform unauthorized configuration changes that could impact sales, inventory accuracy, and logistical downstream processes."
}