CVE-2026-91009 in Active Woot Products Tables for WooCommerce Plugin
Summary
by MITRE • 09/17/2026
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within versions prior to 2.1.3 of the Active Woot Products Tables plugin for WooCommerce represents a critical failure in access control mechanisms, specifically affecting AJAX endpoints that handle post metadata updates. This flaw stems from an absence of both authorization checks and Cross-Site Request Forgery protections on specific administrative actions exposed through the WordPress REST API or custom AJAX handlers. In standard web application security architecture, any action that modifies state must verify two distinct properties: first, that the requester is authenticated with sufficient privileges to perform the operation, and second, that the request originates from a legitimate source intended by the user. The plugin fails on both counts for certain endpoints responsible for updating post titles, thereby exposing arbitrary content modification capabilities to low-privilege users.
From a technical perspective, this vulnerability aligns closely with CWE-862, which describes Missing Authorization, and CWE-352, Cross-Site Request Forgery. The core issue lies in the plugin's implementation of AJAX actions where it accepts input parameters for post IDs and new title values without validating whether the current user session possesses the necessary capabilities defined by WordPress roles such as editor or administrator. By allowing subscribers, who typically have minimal permissions limited to reading content and commenting, to execute write operations on arbitrary posts, pages, and WooCommerce products, the application violates the principle of least privilege. This misconfiguration effectively elevates the attack surface significantly, turning a read-only role into one capable of modifying critical site data without triggering standard security warnings or requiring elevated credentials.
The operational impact of this vulnerability is substantial for any WordPress site utilizing this plugin to display product tables. An attacker with even the lowest level of authenticated access can manipulate the textual representation of products and pages. This capability facilitates several malicious outcomes, including defacement where store branding or information is altered to mislead customers, SEO poisoning by injecting keywords into post titles to manipulate search engine rankings, and potential phishing campaigns if product descriptions are linked to fraudulent sites. Furthermore, because WooCommerce relies heavily on accurate product data for transaction processing and inventory management, altering these fields can disrupt business operations, cause confusion in customer orders, or damage the reputation of the e-commerce entity by displaying incorrect pricing or availability information derived from modified titles.
This behavior is also indicative of a lack of anti-CSRF token validation, which corresponds to CWE-352. Without unique tokens embedded in forms and verified upon submission, an attacker can craft malicious requests that trick authenticated users into unknowingly submitting changes if they are logged in at the time of interaction. Although the primary description highlights arbitrary modification by any authenticated user regardless of role, the absence of CSRF protection compounds the risk by enabling automated exploitation through social engineering or drive-by attacks within compromised networks. The combination of these flaws means that once an attacker gains access to a subscriber account, either through credential theft or registration on public-facing sites, they can systematically alter content across the entire site without detection from standard role-based permission systems.
Mitigation strategies must prioritize immediate updates and rigorous input validation. Site administrators should upgrade Active Woot Products Tables to version 2.1.3 or later where these authorization checks have been implemented by the developers. In cases where upgrading is not immediately feasible, temporary mitigations include restricting access to WordPress admin areas via IP whitelisting if possible, although this does not fully address AJAX endpoints which may be accessible from various origins. Implementing a Web Application Firewall with rules targeting suspicious patterns in post update requests can provide an additional layer of defense by blocking anomalous activity originating from low-privilege accounts attempting write operations. Additionally, enforcing strict role-based access control plugins that audit all administrative actions and logging mechanisms to monitor for unauthorized title changes can help detect exploitation attempts early. Regular security audits focusing on AJAX endpoint permissions are essential to ensure compliance with industry standards such as the OWASP Top Ten regarding broken access control and cross-site request forgery protections.