Executive brief
WC Vendors is a popular WordPress plugin that enables multiple vendors to sell products on a WooCommerce store. The plugin fails to verify that authenticated vendors own the product variations they are modifying, allowing an attacker to alter product listings belonging to competitors (changing prices, SKUs, and status) or corrupt any website page/post content. This could lead to revenue loss, reputation damage, and site defacement.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the product variation save functionality. The plugin's front-end form handler accepts user-supplied variation IDs in the `variable_post_id[]` array without validating ownership or object type before committing changes to the database. An authenticated vendor can craft a POST request to the product-edit endpoint, referencing another vendor's variation ID or any arbitrary post ID, and modify its price, SKU, and status fields. Because the wp_posts UPDATE statement executes before WooCommerce validates the object type, arbitrary posts are also affected. Exploitation requires vendor role access and a valid nonce (which is not per-product), but an attacker does not need to own any product to launch the attack.
Affected products
- WC Vendors WC Vendors before 2.7.2.1
Timeline
- 2026-08-31: disclosed
- 2026: patched: Fixed in version 2.7.2.1
- 2026-09-02: advisory