Quick answers
- Is CVE-2026-48888 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48888 being exploited in the wild.
- How severe is CVE-2026-48888?
- High severity, with a CVSS score of 7.5, published 8 September 2026.
- Which products and versions are affected?
- Automattic WooCommerce before 11.1.0.
- Is there a fix for CVE-2026-48888?
- A patch was published on 2026-09-07: Fixed in version 11.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48888 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-48888?
- Check whether you run Automattic WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is an allocation of resources without limits or throttling (CWE-770) that allows HTTP-based denial of service attacks. The flaw affects WooCommerce versions before 11.1.0 and requires no authentication or special preconditions—any attacker on the network can send crafted requests to trigger uncontrolled resource consumption. By repeatedly sending requests that bypass rate limiting or resource validation, an attacker can exhaust server resources and render the site unavailable. The vulnerability is patched in WooCommerce 11.1.0 and later.
Affected products
- Automattic WooCommerce before 11.1.0
Timeline
- 2026-09-08: disclosed: Published on NVD
- 2026-09-07: patched: Fixed in version 11.1.0
- 2026-08-20: other: Reported by Ananda Dhakal (Patchstack)