CVE-2026-3589: WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
Published Mar 6, 2026
·Updated
The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.
Affected Software
2 affected components
wordpress/woocommerce>=5.4.0<=10.5.2
wordpress/woocommerce<10.5.3
Event History
Mar 6, 2026
CVE Published
via MITRE·09:11 AM
Data Sourced
via MITRE·09:11 AM
DescriptionWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
May 22, 58164
Event
via FIRST·06:20 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-3589?
CVE-2026-3589 has a high severity rating as it allows unauthorized users to create arbitrary admin accounts.
2
How do I fix CVE-2026-3589?
To fix CVE-2026-3589, you should update WooCommerce to version 10.5.3 or later.
3
Who is affected by CVE-2026-3589?
CVE-2026-3589 affects all installations of WooCommerce from version 5.4.0 to 10.5.2.
4
What types of attacks are possible with CVE-2026-3589?
CVE-2026-3589 allows for CSRF attacks that can be exploited to create arbitrary admin users.
5
Is CVE-2026-3589 a critical vulnerability?
Yes, CVE-2026-3589 is considered a critical vulnerability due to its potential impact on site security.