CVE-2026-11364

The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data in versions up to and including 0.8.9. This is due to a missing capability check and missing nonce verification in the __invoke() methods of the AttributeGroupController and AttributeController classes, which are bound to the 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create, edit, and delete arbitrary product specification groups and attributes (taxonomy terms in the 'spec-group' and attribute taxonomies), corrupting business data and impacting the site's frontend display.

• CWE-862

• https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.7/src/EntityUpdater/AttributeController.php#L18
• https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.7/src/EntityUpdater/AttributeGroupController.php#L13
• https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.7/src/EntityUpdater/Module.php#L19
• https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.9/src/EntityUpdater/AttributeController.php#L18
• https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.9/src/EntityUpdater/AttributeGroupController.php#L13
• https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.9/src/EntityUpdater/Module.php#L19
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3580068%40product-specifications&new=3580068%40product-specifications&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/38318605-40f7-4676-b409-f98a6c27cbfe?source=cve

Published

Jun 27, 2026

Last Modified

Jun 29, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11358The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cook…4.4
• CVE-2026-11359The Memberships and User Profiles for WooCommerce – ProfileG…4.3
• CVE-2026-1136A weakness has been identified in lcg0124 BootDo up to e93dd…3.5
• CVE-2026-11360The Advanced Order Export For WooCommerce plugin for WordPre…4.9
• CVE-2026-11361The Formidable Forms WordPress plugin before 6.32.1 does not…5.9
• CVE-2026-11362DataDog::DogStatsd versions through 0.07 for Perl allow metr…9.8
• CVE-2026-11366The MonsterInsights WordPress plugin before 11.1.0 does not…3.7
• CVE-2026-11367The PixMagix – WordPress Image Editor plugin for WordPress i…6.5
• CVE-2026-11368The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) a…6.5
• CVE-2026-11369The Comment API (GET /api/Comment and POST /api/Comment) in …7.1
• CVE-2026-1137A vulnerability was detected in UTT 进取 520W 1.7.7-180627. Af…8.8
• CVE-2026-11370The WP Meta SEO plugin for WordPress is vulnerable to Server…6.4