CVE-2026-115431: WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability

Q: Which installations are affected?

The issue affects the WP Swings Upsell Order Bump Offer for WooCommerce plugin through version 3.1.6. The available data does not identify a fixed version.

Q: What access does an attacker need to exploit this issue?

The provided information identifies missing authorization and incorrectly configured access-control levels, but does not specify the attacker’s required role, authentication status, or the affected functionality.

Q: How can I determine whether my site may be affected?

Check whether Upsell Order Bump Offer for WooCommerce is installed and whether its version is 3.1.6 or earlier. The available information does not provide indicators of compromise or affected endpoints to review.

Published Nov 6, 2026

Updated

Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/upsell-order-bump-offer-for-woocommerce to a version that resolves this vulnerability.
Fixed in 3.1.7

Event History

Nov 6, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects the WP Swings Upsell Order Bump Offer for WooCommerce plugin through version 3.1.6. The available data does not identify a fixed version.

What access does an attacker need to exploit this issue?

The provided information identifies missing authorization and incorrectly configured access-control levels, but does not specify the attacker’s required role, authentication status, or the affected functionality.

How can I determine whether my site may be affected?

Check whether Upsell Order Bump Offer for WooCommerce is installed and whether its version is 3.1.6 or earlier. The available information does not provide indicators of compromise or affected endpoints to review.

CVE-2026-115431: WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

How can I determine whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

How can I determine whether my site may be affected?