CVE-2026-39662 ProWCPlugins CVE debrief

Who should care

Users of the Product Price by Formula for WooCommerce plugin, especially those with versions 2.5.6 or earlier, should be aware of this vulnerability and take necessary actions to secure their installations. This includes WooCommerce users with public-facing sites or sensitive pricing information.

Technical summary

The vulnerability allows unauthorized access due to missing authorization checks in the Product Price by Formula for WooCommerce plugin. This could potentially lead to information disclosure or unintended changes. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-862, Exploiting Incorrectly Configured Access Control Security Levels. The CVSS score is 5.3, with a severity of MEDIUM.

Defensive priority

Medium priority for WooCommerce users, especially those with public-facing sites or sensitive pricing information.

Recommended defensive actions

• Verify and update the Product Price by Formula for WooCommerce plugin to a version beyond 2.5.6.
• Review and restrict access controls for the plugin's functionality.
• Monitor for any unauthorized changes or access attempts related to product pricing.
• Consider implementing additional security measures for WooCommerce installations.
• Review vendor documentation for any specific mitigation guidance.
• Perform a thorough review of the plugin's configuration and usage to identify potential security risks.
• Implement compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent potential attacks.

Evidence notes

The CVE record was published on 2026-04-08T09:16:37.360Z and has not been modified since. The NVD entry is currently Deferred. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The CVE-2026-39662 vulnerability is related to Exploiting Incorrectly Configured Access Control Security Levels, classified under CWE-862. The CVSS score is 5.3, with a severity of MEDIUM. The vulnerability allows unauthorized access due to missing authorization checks in the Product Price by Formula for WooCommerce plugin.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.