02 Records
FEED: ACQUIRING
01 RecordSTATE: PUBLISHED
02 Description
CNA: WPScanWooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
03 Exploitation and scoring
SRC: CISA, FIRST, NVD, RED HAT- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.- EPSS probability
- 0.13% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Ranks above 2.7% of scored records. A rank, not a probability.
- NVD base score
- 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- NVD analysis status
- Deferred. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
SCHEMA: 5.2
- Published
- 2026-03-06 09:11Z6 MO AGO
- Last updated
- 2026-03-06 17:44Z6 MO AGO
- Reserved
- 2026-03-05
- Assigning CNA
- WPScan
- Record state
- PUBLISHED
- Severity
- High (CVSS 7.5)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-352Cross-Site Request Forgery (CSRF)Compound
- Data version
- 5.2
- Document digest
- 3629fba1d5bf67f309d7866e31bf712f81c91cf4eeebba339b5474f069bc45e2
05 Affected products
PAIRS: 1VendorProductVersionsPlatforms
AutomatticWooCommerce5.4.0 to < 5.4.4, 5.5.0 to < 5.4.5, 5.6.0 to < 5.6.3, 5.7.0 to < 5.7.3, 5.8.0 to < 5.8.2, 5.9.0 to < 5.9.2, 6.0.0 to < 6.0.2, 6.1.0 to < 6.1.3, 6.2.0 to < 6.2.3, 6.3.0 to < 6.3.2, 6.4.0 to < 6.4.2, 6.5.0 to < 6.5.2, 6.6.0 to < 6.6.2, 6.7.0 to < 6.7.1, 6.8.0 to < 6.8.3, 6.9.0 to < 6.9.5, 7.0.0 to < 7.0.2, 7.1.0 to < 7.1.2, 7.2.0 to < 7.2.4, 7.3.0 to < 7.3.1, 7.4.0 to < 7.4.2, 7.5.0 to < 7.5.2, 7.6.0 to < 7.6.2, 7.7.0 to < 7.7.3, 7.8.0 to < 7.8.4, 7.9.0 to < 7.9.2, 8.0.0 to < 8.0.5, 8.1.0 to < 8.1.4, 8.2.0 to < 8.2.5, 8.3.0 to < 8.3.4, 8.4.0 to < 8.4.3, 8.5.0 to < 8.5.5, 8.6.0 to < 8.6.4, 8.7.0 to < 8.7.3, 8.8.0 to < 8.8.7, 8.9.0 to < 8.9.5, 9.0.0 to < 9.0.4, 9.1.0 to < 9.1.7, 9.2.0 to < 9.2.5, 9.3.0 to < 9.3.6, 9.4.0 to < 9.4.5, 9.5.0 to < 9.5.4, 9.6.0 to < 9.6.4, 9.7.0 to < 9.7.3, 9.8.0 to < 9.8.7, 9.9.0 to < 9.9.7, 10.0.0 to < 10.0.6, 10.1.0 to < 10.1.4, 10.2.0 to < 10.2.4, 10.3.0 to < 10.3.8, 10.4.0 to < 10.4.4, 10.5.0 to < 10.5.3—