CVE-2026-11568: WooCommerce Product Configurator Authorization Bypass

Technical summary

The plugin fails to implement authorization checks and post-status validation on a public AJAX action handler. The affected endpoint returns full WooCommerce product objects (including metadata like prices, SKUs, weight, and stock status) without verifying either the caller's authentication state or the target post's visibility status. Because the AJAX action is registered as public and callable without nonce validation or capability checks, any unauthenticated user can craft HTTP requests with different product IDs to enumerate and extract data from non-public products. The vulnerability exists in versions prior to 1.7.3.

Business impact

Store operators relying on product privacy—whether for pre-launch testing, exclusive catalogs, pricing experiments, or competitive protection—lose that confidentiality. Competitors or malicious actors gain visibility into product roadmaps, pricing strategies, SKU structures, and inventory levels. For multi-vendor or white-label setups, the exposure may extend to configuration and customization pricing tiers normally hidden from public view. Additionally, the data leakage could facilitate targeted attacks (e.g., price-scraping, catalog theft) and damage brand reputation if sensitive product information is disclosed prematurely.

Affected systems

WordPress installations running the Product Configurator for WooCommerce plugin in versions before 1.7.3 are affected. The vulnerability is present regardless of WordPress configuration, theme, or other plugins; it is inherent to the unpatched plugin code. All products on such sites—including those marked private, draft, or scheduled—are potentially exposed if their product IDs are known or guessed.

Exploitability

Exploitability is very high. No authentication is required; no special user interaction is needed; and the exploit is network-accessible from any location. An attacker needs only the product ID, which can be discovered through enumeration, source code inspection, database leaks, or informed guessing. The AJAX endpoint likely responds quickly with structured JSON, making bulk reconnaissance practical. Proof-of-concept is straightforward: a single HTTP POST request to the vulnerable action endpoint with a product ID parameter will return the sensitive data.

Remediation

Update the Product Configurator for WooCommerce plugin to version 1.7.3 or later. This version includes authorization and post-status checks that prevent unauthenticated users from accessing non-public product data. Verify the update is installed and activated; the fix is not configuration-based and requires a plugin upgrade.

Patch guidance

Ensure your WordPress installation has automatic plugin updates enabled, or manually update the Product Configurator for WooCommerce plugin via the Plugins > Updates dashboard. After updating, confirm the plugin is activated and test by attempting to access a private product ID via the AJAX endpoint—the request should be blocked or return no sensitive data. If you cannot update immediately, consider disabling the plugin temporarily on production sites, though this will break product configurator functionality.

Detection guidance

Monitor web server access logs for POST requests to /wp-admin/admin-ajax.php with the product configurator action name and unexpected product ID parameters. Correlate these with unauthenticated sessions (no WordPress user cookie or a 'not logged in' cookie value). Query your WordPress audit logs (if available via a logging plugin) for AJAX calls from non-admin users. Review WooCommerce product modification logs to see if any private products were accessed. Network-based WAF rules can flag suspicious patterns of enumeration (many different product IDs in a short window). If you suspect exploitation, cross-reference access times with product visibility changes or customer complaints about premature product exposure.

Why prioritize this

This vulnerability scores 7.5 (HIGH) because it enables high-impact confidentiality breaches with no barriers to exploitation. While it does not allow data modification, deletion, or system compromise, the unauthorized disclosure of private product data—especially pricing and SKU information—poses genuine business risk. The lack of authentication and the simplicity of the exploit make this a routine attack target for competitors and data thieves. Immediate patching is warranted, particularly for stores with price-sensitive or pre-launch products.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N). The scope is unchanged (S:U), meaning the impact is limited to the affected component. The score penalizes high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N). The lack of authentication requirement and the triviality of exploitation elevate the score despite the narrow impact scope. Organizations with confidential product catalogs should treat this as high-priority.

Frequently asked questions