Is CVE-2026-56050 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56050 being exploited in the wild.

How severe is CVE-2026-56050?

Medium severity, with a CVSS score of 6.5, published 25 June 2026.

Which products and versions are affected?

Themeisle PPOM for WooCommerce n/a through 33.0.18.

Is there a fix for CVE-2026-56050?

A patch was published on 2026-06-25: Fixed in version 34.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56050 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56050?

Check whether you run Themeisle PPOM for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56050: Themeisle PPOM for WooCommerce improper access control

CVE-2026-56050 · Severity: medium · CVSS 6.5 · Published 2026-06-25

Themeisle PPOM for WooCommerce is a WordPress plugin used to add custom fields and options to product pages. A security flaw in the plugin's access control settings allows unauthorized individuals to perform actions that should be restricted to administrators. This could lead to unauthorized changes to product configurations or disruptions to the online store's operations.

Vendors: Themeisle.

Quick answers

Is CVE-2026-56050 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56050 being exploited in the wild.
How severe is CVE-2026-56050?: Medium severity, with a CVSS score of 6.5, published 25 June 2026.
Which products and versions are affected?: Themeisle PPOM for WooCommerce n/a through 33.0.18.
Is there a fix for CVE-2026-56050?: A patch was published on 2026-06-25: Fixed in version 34.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56050 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56050?: Check whether you run Themeisle PPOM for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-284) exists in the Themeisle PPOM for WooCommerce plugin for WordPress. The flaw stems from incorrectly configured access control security levels, which fail to properly validate authorization or authentication tokens for certain functions. An unauthenticated remote attacker can exploit this vulnerability to execute actions that should require higher privileges, potentially impacting the integrity and availability of the plugin's data. The issue affects versions up to and including 33.0.18 and is resolved in version 34.0.0.

Affected products

Themeisle PPOM for WooCommerce n/a through 33.0.18

Timeline

2026-04-29: other: Reported by HaiND
2026-06-25: advisory: Published by Patchstack and NVD
2026-06-25: patched: Fixed in version 34.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.