CVE-2026-109926: Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Productive Commerce WordPress pluginto a version that resolves this vulnerability.Fixed in 1.1.49
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user, including a user with only the Subscriber role, can exploit it. The affected AJAX nonce is exposed on every admin-area page, and the action lacks a capability check.
What must be present for exploitation to have an impact?
The attacker needs an account that can access the WordPress admin area. The plugin they want to activate must already be installed on the site; this issue activates arbitrary installed Productive Commerce plugins rather than installing new ones.
Which versions should be remediated?
Productive Commerce WordPress plugin versions earlier than 1.1.49 are affected. Update to version 1.1.49 or later.