CVE-2026-49110: Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce ≤3.1.4

Technical summary

CVE-2026-49110 is an unauthenticated broken authentication vulnerability (CWE-1284) in the Upsell Order Bump Offer plugin for WooCommerce through version 3.1.4. The vulnerability allows attackers to bypass authentication mechanisms and execute unauthorized actions. The CVSS 3.1 score of 7.5 (HIGH severity) with a network-adjacent attack vector, low complexity, no privileges required, no user interaction, and high integrity impact indicates that an attacker can remotely modify data or store functionality without proper authorization. The vulnerability does not affect confidentiality or availability in the base case but creates significant integrity risks.

Business impact

Exploitation of this vulnerability could allow attackers to manipulate order data, modify product pricing in upsells, alter customer information, or change plugin configurations without authorization. This could result in financial loss through order tampering, reputational damage if customer data is compromised, and potential regulatory exposure if payment or personal information is affected. For e-commerce merchants relying on WooCommerce, even temporary unauthorized access to order bumping functionality creates risk of revenue leakage and loss of customer trust.

Affected systems

The vulnerability affects WordPress installations using the Upsell Order Bump Offer plugin version 3.1.4 and earlier. Any WooCommerce store with this plugin enabled and not updated to a patched version is at risk. The vulnerability is remotely exploitable and does not require special conditions like VPN access or network positioning—any attacker with internet connectivity to the affected WooCommerce site can attempt exploitation.

Exploitability

This vulnerability is highly exploitable due to its unauthenticated nature, network accessibility, and low complexity. No special tools, advanced knowledge, or user interaction is required. An attacker simply needs to identify a WooCommerce store running the vulnerable plugin version and send malicious requests to trigger the authentication bypass. The lack of KEV (Known Exploited Vulnerability) designation does not indicate low exploitability—rather, it reflects the current tracking status. Organizations should prioritize remediation as if active exploitation is likely.

Remediation

Immediately update the Upsell Order Bump Offer plugin to a version newer than 3.1.4. Verify the patched version against the vendor's official advisory and release notes. Additionally, review recent order activity logs and plugin access logs for any suspicious modifications. Consider implementing Web Application Firewall (WAF) rules to detect and block unauthenticated requests to sensitive plugin endpoints while patching is being deployed. For WordPress instances where immediate patching is not feasible, disable the plugin until an update is available.

Patch guidance

Check the Upsell Order Bump Offer plugin repository or vendor advisory for the available patched version. Update via the WordPress plugin dashboard: navigate to Plugins, find Upsell Order Bump Offer, and apply the available update. Test the updated plugin in a staging environment first to ensure compatibility with your WooCommerce configuration and any custom order bump workflows. Verify that the update does not conflict with other plugins or custom code before deploying to production.

Detection guidance

Monitor web server access logs for suspicious requests to WooCommerce plugin endpoints, particularly those related to order processing or plugin configuration without corresponding authentication tokens or user session data. Look for POST or GET requests with unusual parameter combinations or requests that bypass standard checkout flows. Implement security logging on the Upsell Order Bump Offer plugin to capture who performs order modifications and when. Use WordPress security plugins to monitor file integrity and configuration changes. Search your WooCommerce order logs for orders created or modified without corresponding user session activity.

Why prioritize this

This vulnerability warrants HIGH priority remediation due to its direct impact on order integrity—the core business function of any e-commerce store. The CVSS score of 7.5 reflects high integrity impact, unauthenticated access, and network accessibility. The lack of KEV designation should not lower urgency; the vulnerability's design (broken authentication on order-critical functionality) makes it attractive to attackers regardless of current public exploitation status. Stores handling payment processing or sensitive customer data face compounded regulatory and financial risk.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: (1) Network Attack Vector—the vulnerability is remotely exploitable; (2) Low Attack Complexity—no special conditions or tools required; (3) No Privileges Required—attackers need no valid credentials; (4) No User Interaction—the attack is fully automated; (5) High Integrity Impact—attackers can modify order data and plugin settings. The vector does not indicate confidentiality or availability loss in the base scenario, but the ability to tamper with orders creates substantial business risk. This score appropriately reflects a HIGH-severity vulnerability requiring urgent remediation.

Frequently asked questions