CVE-2026-103899 daigo75 CVE debrief

Who should care

Defenders responsible for WooCommerce installations using the EU VAT Assistant plugin, especially those with administrator accounts, should assess exposure and prioritize mitigation to prevent privilege escalation and potential site takeover.

Why it matters

CVE-2026-103899 is a high-severity vulnerability in the EU VAT Assistant for WooCommerce plugin, allowing unauthenticated attackers to inject malicious scripts and potentially escalate privileges to administrator accounts. Defenders should verify exposure, prioritize mitigation, and implement compensating controls to prevent site takeover.

• Privilege escalation to administrator account takeover
• Injection of arbitrary web scripts in WooCommerce order pages
• Potential for site takeover via rogue administrator account creation
• Verification of input sanitization and output escaping implementation

Technical summary

The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413. This is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order, enabling privilege escalation up to and including full site takeover via rogue administrator account creation.

Defensive priority

Defenders should prioritize verifying exposure of WooCommerce installations using the EU VAT Assistant plugin, especially those with administrator accounts that could be targeted for privilege escalation.

Recommended defensive actions

• Verify WooCommerce installations for the EU VAT Assistant plugin version 2.1.30.260413 or earlier
• Assess administrator account exposure and prioritize privilege escalation mitigation
• Implement input sanitization and output escaping for the 'vat_number' parameter
• Monitor for suspicious activity related to WooCommerce orders and administrator accounts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.2 and the affected plugin versions. However, the corpus lacks specific information on exploitation, victims, or business impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.