Executive brief
The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized data modification. This allows any logged-in user, even those with low-level 'Subscriber' permissions, to create, edit, or delete product specification groups and attributes. This can lead to the corruption of product data and negatively impact how information is displayed to customers on the website's storefront.
Technical details
The vulnerability is classified as a missing authorization (CWE-862) and missing nonce verification issue within the __invoke() methods of the AttributeGroupController and AttributeController classes. These classes handle the 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX actions. Because these actions lack proper capability checks, an authenticated attacker with Subscriber-level privileges or higher can perform unauthorized CRUD operations on 'spec-group' and attribute taxonomies. This allows for the arbitrary modification of product specification data. The issue is addressed in versions following 0.8.9.
Affected products
- dornaweb Product Specifications for WooCommerce <= 0.8.9
Timeline
- 2026-06-27: disclosed
- 2026-06-27: advisory
References
- https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.7/src/EntityUpdater/AttributeController.php
- https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.7/src/EntityUpdater/AttributeGroupController.php
- https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.7/src/EntityUpdater/Module.php
- https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.9/src/EntityUpdater/AttributeController.php
- https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.9/src/EntityUpdater/AttributeGroupController.php
- https://plugins.trac.wordpress.org/browser/product-specifications/tags/0.8.9/src/EntityUpdater/Module.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3580068%40product-specifications&new=3580068%40product-specifications&sfp_email=&sfph_mail=