Executive brief
WooCommerce is a widely-used e-commerce plugin for WordPress that enables online stores. An unauthenticated attacker can exploit a resource exhaustion flaw to overwhelm the plugin with requests, causing a website to become slow or go offline and disrupting customer shopping and business operations.
Technical details
This vulnerability is an allocation of resources without limits or throttling (CWE-770) that allows HTTP-based denial of service attacks. The flaw affects WooCommerce versions before 11.1.0 and requires no authentication or special preconditions—any attacker on the network can send crafted requests to trigger uncontrolled resource consumption. By repeatedly sending requests that bypass rate limiting or resource validation, an attacker can exhaust server resources and render the site unavailable. The vulnerability is patched in WooCommerce 11.1.0 and later.
Affected products
- Automattic WooCommerce before 11.1.0
Timeline
- 2026-09-08: disclosed: Published on NVD
- 2026-09-07: patched: Fixed in version 11.1.0
- 2026-08-20: other: Reported by Ananda Dhakal (Patchstack)