CVE-2026-106608 HIGH

CVE-2026-106608: WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability

Vendor Automattic

Product WooCommerce

Weakness CWE-266

Published October 10, 2026

Last update October 10, 2026

View on NVD All CVEs

CVSS base score

7.2/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

Key dates

02Disclosure timeline

October 10, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-106608 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/266.html AskarLabs — CWE-266 write-up Incorrect Privilege Assignment

Related vulnerabilities

04Related CVE

CVE-2026-27407 WordPress AI Engine plugin <= 3.4.9 - Privilege Escalation vulnerability CVE-2026-32566 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability CVE-2026-32519 WordPress Bit SMTP plugin <= 1.2.2 - Broken Authentication vulnerability CVE-2026-42758 WordPress WebinarIgnition plugin < 4.08.253 - Privilege Escalation vulnerability CVE-2026-59541 WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability