# CVE-2026-106608: Automattic WooCommerce privilege assignment vulnerability

Source: https://junglewise.ai/threats/cve-2026-106608-incorrect-privilege-assignment-vulnerability-in-automattic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-106608 · Severity: high · CVSS 7.2 · Published 2026-10-10

WooCommerce is an e-commerce plugin that allows merchants to set up and manage online stores within WordPress. This vulnerability allows a low-privilege user (such as a shop manager) to escalate their account permissions and gain full administrative control of the entire WordPress installation. An attacker with any user account on the site could potentially compromise all customer data, payment information, and site configuration.

Technologies: [Automattic WooCommerce](https://junglewise.ai/threats/technologies/woocommerce). Vendors: [Automattic](https://junglewise.ai/threats/vendors/automattic).

## Quick answers

**Is CVE-2026-106608 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106608 being exploited in the wild.

**How severe is CVE-2026-106608?** High severity, with a CVSS score of 7.2, published 10 October 2026.

**Which products and versions are affected?** Automattic WooCommerce 9.8.0 through 11.1.2.

**Is there a fix for CVE-2026-106608?** Yes: fixed in 11.2.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106608 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106608?** Check whether you run Automattic WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 11.2.0

## Technical details

An incorrect privilege assignment vulnerability in WooCommerce allows privilege escalation when a user with low-level roles (e.g., shop manager) can gain admin-level access through an authentication or identification failure. The vulnerability affects versions 9.8.0 through 11.1.2 and requires only the ability to interact with the WordPress installation as an authenticated low-privilege user. This is fixed in version 11.2.0.

## Affected products

- Automattic WooCommerce 9.8.0 through 11.1.2

## Timeline

- 2026-10-08: disclosed
- 2026-10-10: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-9-8-0-11-1-2-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-9-8-0-11-1-2-privilege-escalation-vulnerability?_s_id=cve)

## Related threats

- [Automattic WooCommerce denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-48888-automattic-woocommerce-denial-of-service-via-resource-exhaustion)
- [Automattic WooCommerce SQL injection in Analytics reports](https://junglewise.ai/threats/cve-2026-57777-automattic-woocommerce-sql-injection-in-analytics-reports)
- [WooCommerce remote code execution in product-type parameter](https://junglewise.ai/threats/cve-2022-50972-woocommerce-remote-code-execution-in-product-type-parameter)