CVE-2026-12736 in Woo Plugin
Summary
by MITRE • 07/24/2026
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability in the Wpify Woo plugin represents a critical privilege escalation flaw that undermines WordPress security controls through improper input validation and insufficient access restrictions. This weakness exists within the SettingsApi::save_option() REST endpoint which processes POST requests to /wp-json/wpify-woo/v1/option, creating an attack surface where malicious actors can manipulate core WordPress configuration settings. The vulnerability affects all plugin versions up to and including 5.4.16, making it a persistent threat across multiple releases that require immediate remediation efforts.
The technical implementation of this flaw stems from the complete absence of input sanitization and validation mechanisms within the REST API route. When attackers submit requests containing 'option' and 'data' parameters, these values are directly passed to WordPress's native update_option() function without any filtering or allowlisting of permitted option names. This unfiltered parameter handling creates a direct pathway for arbitrary code execution through configuration manipulation, as demonstrated by the ability to modify core WordPress settings such as default_role and users_can_register. The vulnerability aligns with CWE-20, representing an input validation weakness where insufficient sanitization allows attackers to inject malicious values into system configurations.
The operational impact of this privilege escalation vulnerability extends far beyond simple access control bypasses, as it enables attackers to fundamentally alter the security posture of affected WordPress installations. An authenticated attacker with Shop Manager privileges can leverage this flaw to elevate their permissions to full Administrator level, effectively gaining complete control over the website's functionality and data. This includes the ability to disable security plugins by manipulating the active_plugins option, modify user roles and capabilities, and potentially establish persistent backdoors through configuration changes. The attack vector requires only basic authentication access, making it particularly dangerous as it can be exploited by attackers who have already gained some level of access to the WordPress admin interface.
Security mitigations for this vulnerability must address both the immediate code-level issues and broader architectural concerns within the plugin's REST API implementation. The most effective solution involves implementing strict parameter validation that maintains allowlists of permitted option names, combined with comprehensive sanitization of all input values before processing. Additionally, the permission_callback mechanism should be strengthened to verify not just basic WooCommerce management capabilities but also specific administrative privileges required for configuration changes. This vulnerability maps directly to ATT&CK technique T1078.004, which covers valid accounts with elevated privileges, and represents a classic case of insufficient authorization checks that could be addressed through proper input validation and privilege separation mechanisms as recommended in the OWASP Top Ten security standards.
The attack scenario begins with an authenticated Shop Manager account gaining access to the WordPress admin interface, followed by exploitation of the REST API endpoint through crafted HTTP POST requests targeting the vulnerable SettingsApi::save_option() method. Attackers can systematically enumerate available options and craft malicious payloads that modify core WordPress settings to achieve privilege escalation. The vulnerability's impact is amplified by its ability to disable security measures such as security plugins, effectively removing defensive controls from the target environment while simultaneously elevating attacker privileges. Organizations should implement immediate patching procedures, monitor for suspicious REST API activity, and conduct thorough security audits of all WordPress plugins to identify similar vulnerabilities that may exist within their broader technology stack.