Executive brief
The Active Products Tables for WooCommerce WordPress plugin is a free tool that helps store owners display product information in table format. Due to missing authorization checks in certain AJAX actions, any authenticated user—even those with minimal permissions like subscribers—can change the titles of any posts, pages, or products on the site. This could result in defaced content, broken product listings, and damage to store reputation.
Technical details
The vulnerability is a broken access control issue (CWE-862) in the plugin's AJAX action handler, specifically the woot_update_attachment function. The plugin fails to verify that the user making the request has authorization to modify the target post, allowing any authenticated user to change post titles without proper capability checks. The attack requires only authentication; no CSRF token validation is performed. An attacker with subscriber-level access or higher can craft a malicious AJAX request to modify titles of arbitrary posts, pages, or products. The vulnerability was patched in version 2.1.3.
Affected products
- Active Woot Products Tables for WooCommerce before 2.1.3
Timeline
- 2026-09-15: disclosed
- 2026-09-01: patched: Fixed in version 2.1.3
- 2026-09-17: advisory