CVE-2026-86785: Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update
Published Sep 23, 2026
·Updated
The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.
Affected Software
1 affected component
Social Commerce for WooCommerce<=2.5.4
Event History
Sep 23, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require a WordPress account or other authentication?
No. The affected REST API endpoints can be used by unauthenticated users because they lack authorization checks.
2
What can an attacker change through the affected endpoints?
An attacker can update the plugin's configuration and its product synchronization state.
3
Which plugin versions are known to be affected?
Social Commerce for WooCommerce versions through 2.5.4 are affected.