Junglewise Threat Intelligence

CVE-2026-12736: Wpify Woo privilege escalation in SettingsApi

CVE-2026-12736 · Severity: high · CVSS 8 · Published 2026-07-24

Executive brief

The Wpify Woo plugin for WordPress, which provides e-commerce enhancements like QR payments and VAT management, contains a security flaw that allows certain authorized users to gain full administrative control over a website. By exploiting this vulnerability, a user with 'Shop Manager' permissions can change critical site settings, create new administrator accounts, or disable security protections. This could lead to a total takeover of the website and exposure of customer data.

Technical details

The Wpify Woo plugin for WordPress is vulnerable to privilege escalation in versions up to and including 5.4.16 due to an insecure implementation of the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option). The route passes user-supplied 'option' and 'data' parameters directly to the WordPress update_option() function without an allowlist or sanitization. While the route requires the 'manage_woocommerce' capability, authenticated attackers with Shop Manager-level access can exploit this to overwrite arbitrary site options. This can be used to enable user registration with an administrator default role or disable security plugins, leading to full site compromise.

Affected products

  • Wpify Wpify Woo up to, and including, 5.4.16

Timeline

  • 2026-07-24: disclosed: CVE published by Wordfence/NVD

References