CVE-2026-125801: WordPress WooCommerce plugin 11.0.0-11.2.2 - Race Condition vulnerability
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic WooCommerce woocommerce allows Leveraging Race Conditions.This issue affects WooCommerce: from 11.0.0 through 11.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/woocommerceto a version that resolves this vulnerability.Fixed in 11.3.0
Event History
Frequently Asked Questions
Which WooCommerce installations are affected?
The issue affects WooCommerce versions 11.0.0 through 11.2.2. The provided information does not state whether any particular WordPress or WooCommerce configuration is required.
Does exploiting this issue require an authenticated user or user interaction?
No privileges and no user interaction are required according to the supplied CVSS vector. Exploitation is network-accessible, but has high attack complexity.
What is the potential impact of successful exploitation?
Successful exploitation may result in high confidentiality impact and low integrity impact. No availability impact is indicated.