CVE-2026-48888: WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.
This issue affects WooCommerce: from n/a before 11.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WooCommerce pluginto a version that resolves this vulnerability.Fixed in 11.1.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
Event History
Frequently Asked Questions
Which WooCommerce installations are affected?
WooCommerce versions before 11.1.0 are affected. The available data does not identify any configuration prerequisites or exclusions.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates the issue is remotely exploitable over the network with low attack complexity, requires no privileges, and requires no user interaction.
What is the expected impact of successful exploitation?
Successful exploitation can cause an HTTP denial of service through uncontrolled resource allocation. The provided CVSS vector indicates availability impact only, with no stated confidentiality or integrity impact.
What should teams do if they cannot patch immediately?
The provided data does not specify a workaround or mitigation. Prioritize upgrading WooCommerce to 11.1.0 or later when possible, and monitor for HTTP resource-exhaustion or availability symptoms.