CVE-2026-118072: Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting
The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with the Subscriber role or a higher-privileged role can exploit it. The attacker does not need permission to manage orders.
What is the impact of successful exploitation?
An attacker can add customer details from an order to the store's fraud blacklist. This can prevent legitimate customers from placing orders.
Which installations are affected?
Installations running Fraud Prevention For WooCommerce and EDD versions earlier than 2.3.6 are affected. The issue applies where users can authenticate with Subscriber-level access or higher.
What should be done if updating is not immediately possible?
Restrict or remove Subscriber and other untrusted authenticated accounts where feasible, since exploitation requires an authenticated user. Review the fraud blacklist for customer details that may have been added without authorization.