Read the docs
TI-2026-78618 Aliases CVE-2026-109926GHSA-h4jv-2hjr-9f5x

Missing authorization in Productive Commerce allows plugin activation

Priority LOW 20CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

The Productive Commerce WordPress plugin before 1.1.49 does not check capabilities in one of its AJAX actions (CWE-862). The nonce that guards this action is exposed on every admin-area page, so any authenticated user, such as a subscriber, can activate arbitrary plugins already installed on the site. An exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Productive Commerce (Unknown): 1.1.49

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownProductive Commercebefore 1.1.491.1.49Patch availableCNA
  • Productive Commerce VendorUnknown Affected before 1.1.49 Fixed in 1.1.49 Patch available CNA

Remediation

Update Productive Commerce to version 1.1.49, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Productive Commerce (Unknown) Fixed in 1.1.49

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-109926
  2. 2026-10-21 Alias added: GHSA-h4jv-2hjr-9f5x

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences