Improper privilege management in WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka…
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpify | WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce | up to 5.4.16 | — | No fix listed | CNA |
- WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce Vendorwpify Affected up to 5.4.16 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-12736
- 2026-10-03 Alias added: GHSA-jp43-qmg3-xrhw
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a9b8f2d5-a2c5-4f90-ab1d-4e17f7a7996e?source=cve
- https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.9/src/Api/SettingsApi.php#L67
- https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.10/src/Api/SettingsApi.php#L67
- https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.10/src/Api/SettingsApi.php#L39
- https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.10/src/Managers/ApiManager.php#L18
- https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.9/src/Api/SettingsApi.php#L39
- https://plugins.trac.wordpress.org/browser/wpify-woo/tags/5.4.9/src/Managers/ApiManager.php#L18
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3614762%40wpify-woo&new=3614762%40wpify-woo
More wpify vulnerabilities
- TI-2026-30971 WordPress WPify Woo Czech plugin <= 5.4.1 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.9
- TI-2024-01394 WPify Woo Czech <= 4.0.8 - Missing Authorization CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-12736 · CVE Program
- CVE-2026-12736 · NVD
- FIRST EPSS
- GHSA-jp43-qmg3-xrhw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences