CVE-2026-91009: Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Active Products Tables for WooCommerce (Woot Products Tables)to a version that resolves this vulnerability.Fixed in 2.1.3 - Compensating control
As a mitigation until the plugin is upgraded to version 2.1.3, restrict access so that subscriber-level users cannot reach the affected AJAX action (woot_update_attachment) that allows arbitrary post/page/product title modification.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user can exploit it, including users with only the Subscriber role. An attacker must be able to log in to the affected WordPress site.
What can an attacker change?
An authenticated attacker can change the title of arbitrary WordPress posts, pages, and WooCommerce products through affected AJAX actions.
Which plugin versions are affected?
Versions of Active Woot Products Tables for WooCommerce before 2.1.3 are affected. Updating to 2.1.3 or later addresses the affected version range.