Vulnerabilities
Critical SQL Injection Flaw Found in ELEX WooCommerce Plugin Versions 1.5.3 and Below
The National Vulnerability Database rates CVE-2026-40800 as critical, affecting the ELEX WooCommerce Advanced Bulk Edit Products plugin.
WooCommerce
Everything Threat Times has reported about WooCommerce: 6 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Critical Unauthenticated PHP Injection Flaw Found in Payever WooCommerce Plugin
The NVD rates CVE-2026-42716 as critical with a 9.8 score, affecting Payever WooCommerce Gateway versions up to 4.8.2 through unauthenticated object injection.
Vulnerabilities
Unauthenticated PHP Object Injection Flaw in Booster for WooCommerce Rated Critical
A critical vulnerability in Booster for WooCommerce allows unauthenticated attackers to inject PHP objects, earning a CVSS score of 9.8.
Vulnerabilities
VillaTheme AFFI Plugin Has Critical Object Injection Vulnerability
A CVSS 9.8 flaw in VillaTheme AFFI – Affiliate Marketing for WooCommerce allows object injection through untrusted data deserialization.
Vulnerabilities
Critical WordPress Plugin Flaw Allows Unauthenticated File Deletion and Remote Code Execution
A critical vulnerability in the PPOM WooCommerce plugin lets attackers delete server files, potentially enabling remote code execution in versions up to 34.0.10.
Vulnerabilities
Critical RCE Vulnerability Found in 3D Product Configurator for WooCommerce Plugin
Unauthenticated attackers can execute arbitrary code on WordPress sites using the vulnerable 3D Product Configurator plugin due to missing security checks.