CVE-2026-118072 in Fraud Prevention for WooCommerce and Edd Plugin
Summary
by MITRE • 10/30/2026
The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in versions of the Fraud Prevention For WooCommerce and EDD WordPress plugin prior to version 2.3.6 represents a critical failure in access control logic within an e-commerce environment. This flaw specifically affects the mechanism used by administrators or authorized personnel to add customer details, such as email addresses or IP ranges, to a fraud blacklist intended to block malicious actors from completing purchases. The core technical deficiency lies in the absence of proper authorization checks when processing requests to update this blacklist. Specifically, the application does not verify whether the authenticated user initiating the request possesses the necessary permissions to manage orders or modify security settings before executing the action that adds an entry to the deny list.
From a technical perspective, this is a classic example of Broken Access Control, categorized under CWE-269 in the Common Weakness Enumeration standards. The vulnerability arises because the server-side logic relies on assumptions about user intent rather than enforcing strict role-based access control policies. In WordPress ecosystems, capabilities are typically tied to specific roles such as Administrator or Shop Manager. However, this plugin fails to validate that the current session holds these elevated privileges before allowing modifications to sensitive configuration data like fraud prevention lists. Consequently, any authenticated user with a Subscriber role or higher can interact with the blacklist management interface and successfully submit requests to add arbitrary entries without triggering an authorization error.
The operational impact of this vulnerability is significant for online retailers relying on WooCommerce or Easy Digital Downloads platforms. An attacker possessing even basic subscriber-level access could exploit this flaw to engage in denial-of-service attacks against legitimate customers. By systematically adding the email addresses, IP addresses, or other identifying details of genuine shoppers to the fraud blacklist, an adversary can effectively block these individuals from completing transactions. This results in direct revenue loss for the merchant due to abandoned carts and frustrated customer bases. Furthermore, it undermines trust in the platform's security infrastructure, as legitimate users are unfairly penalized based on manipulated data rather than actual fraudulent behavior.
This type of vulnerability aligns with several tactics described in the MITRE ATT&CK framework, particularly those related to privilege escalation or abuse of configuration settings for malicious ends. While not a direct compromise of system integrity through code execution, it constitutes an abuse of administrative functions by lower-privileged users, which falls under techniques involving unauthorized modification of security controls. The ability to arbitrarily blacklist customers effectively weaponizes the fraud prevention tool against its intended purpose, turning a protective measure into a vector for disruption and potential extortion if combined with other social engineering tactics.
To mitigate this vulnerability, immediate action is required by updating the plugin to version 2.3.6 or later where these access control checks have been implemented. Administrators should also review user roles within their WordPress installation to ensure that only trusted individuals hold subscriber-level accounts and above, minimizing the attack surface for such unauthorized actions. Implementing strict role-based access controls at the application level is essential to prevent lower-privileged users from interacting with sensitive administrative features. Additionally, enabling comprehensive logging of blacklist modifications can help detect any suspicious activity or unauthorized changes in real-time, allowing for rapid incident response if exploitation attempts are detected before significant damage occurs.