PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39662 ProWCPlugins CVE debrief

The CVE-2026-39662 vulnerability is a Missing Authorization issue in the Product Price by Formula for WooCommerce plugin, affecting versions from n/a through 2.5.6. This vulnerability is related to Exploiting Incorrectly Configured Access Control Security Levels, classified under CWE-862. The CVSS score is 5.3, with a severity of MEDIUM. The vulnerability allows unauthorized access due to missing authorization checks in the plugin. This could potentially lead to information disclosure or unintended changes. Users of the Product Price by Formula for WooCommerce plugin, especially those with versions 2.5.6 or earlier, should be aware of this vulnerability and take necessary actions to secure their installations.

Vendor
ProWCPlugins
Product
Product Price by Formula for WooCommerce
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of the Product Price by Formula for WooCommerce plugin, especially those with versions 2.5.6 or earlier, should be aware of this vulnerability and take necessary actions to secure their installations. This includes WooCommerce users with public-facing sites or sensitive pricing information.

Technical summary

The vulnerability allows unauthorized access due to missing authorization checks in the Product Price by Formula for WooCommerce plugin. This could potentially lead to information disclosure or unintended changes. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-862, Exploiting Incorrectly Configured Access Control Security Levels. The CVSS score is 5.3, with a severity of MEDIUM.

Defensive priority

Medium priority for WooCommerce users, especially those with public-facing sites or sensitive pricing information.

Recommended defensive actions

  • Verify and update the Product Price by Formula for WooCommerce plugin to a version beyond 2.5.6.
  • Review and restrict access controls for the plugin's functionality.
  • Monitor for any unauthorized changes or access attempts related to product pricing.
  • Consider implementing additional security measures for WooCommerce installations.
  • Review vendor documentation for any specific mitigation guidance.
  • Perform a thorough review of the plugin's configuration and usage to identify potential security risks.
  • Implement compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent potential attacks.

Evidence notes

The CVE record was published on 2026-04-08T09:16:37.360Z and has not been modified since. The NVD entry is currently Deferred. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The CVE-2026-39662 vulnerability is related to Exploiting Incorrectly Configured Access Control Security Levels, classified under CWE-862. The CVSS score is 5.3, with a severity of MEDIUM. The vulnerability allows unauthorized access due to missing authorization checks in the Product Price by Formula for WooCommerce plugin.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T09:16:37.360Z and has not been modified since.