CVE-2026-86850 in SKU Error Fixer for WooCommerce Plugin
Summary
by MITRE • 10/09/2026
The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in the SKU Error Fixer for WooCommerce WordPress plugin version 1.0 represents a critical failure in access control mechanisms within the application's AJAX handling logic. Specifically, two distinct AJAX endpoints exposed by the plugin lack essential security validations, namely capability checks and nonce verification. In standard WordPress development practices, nonces are used to prevent Cross-Site Request Forgery attacks, while capability checks ensure that only users with specific administrative privileges can execute sensitive operations. The absence of these controls means that any user interacting with the site, including unauthenticated visitors or low-privilege subscribers, can invoke these actions without providing valid authentication tokens or possessing elevated permissions. This fundamental oversight transforms what should be restricted administrative functions into publicly accessible features, creating a significant attack surface for malicious actors targeting WooCommerce-based e-commerce sites.
The operational impact of this vulnerability is severe due to the nature of the operations permitted through these unauthenticated endpoints. One of the affected actions allows an attacker to permanently delete product variations that the plugin has classified as obsolete. Because there are no recovery mechanisms in place, such deletions result in irreversible data loss for the e-commerce store owner. Product variations often contain critical pricing and inventory information; their sudden removal can disrupt sales operations and require significant effort to restore from backups if available. The second affected action enables the disclosure of detailed information regarding these product variations. This exposure allows attackers to enumerate sensitive catalog data, which may include SKU numbers, stock levels, pricing structures, and other metadata that could be leveraged for further attacks or competitive intelligence gathering.
From a technical classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-352 Cross-Site Request Forgery (CSRF). The lack of nonce verification directly facilitates CSRF attacks, where an attacker can trick an authenticated administrator into performing actions they did not intend to perform by embedding malicious requests in a webpage or email. However, because the endpoints are accessible even without authentication, the risk extends beyond traditional CSRF scenarios to include direct exploitation by unauthenticated users. This scenario is also consistent with ATT&CK technique T1059 Command and Scripting Interpreter if the underlying implementation allows for broader command execution, though primarily it falls under privilege escalation or unauthorized data modification categories depending on whether an attacker exploits this via a logged-in user's session or directly as an anonymous visitor. The combination of information disclosure and destructive capability makes this a high-severity issue that requires immediate remediation to prevent both data integrity compromise and potential business disruption for WooCommerce store operators utilizing the affected plugin version.