CVE-2026-96817 in MakeCommerce Plugin
Summary
by MITRE • 09/30/2026
Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as Subscriber Broken Access Control within the MakeCommerce plugin for WordPress, specifically affecting versions up to and including 4.1.0, represents a critical failure in enforcing proper authorization policies on user-specific data endpoints. This flaw allows authenticated users with lower privilege levels, such as standard subscribers or customers, to bypass intended restrictions and access sensitive information belonging to other users within the same system. The core of this issue lies in the application's inability to properly validate whether the requesting user has the necessary permissions to view or manipulate specific resources associated with a different subscriber account. In typical web applications built on WordPress architectures, data isolation is paramount for maintaining privacy and security integrity, particularly when dealing with personal identifiable information (PII) such as email addresses, purchase histories, shipping details, and payment tokens stored in user meta tables.
From a technical perspective, this vulnerability stems from insufficient server-side validation of the relationship between the authenticated session token and the resource identifier being requested via API endpoints or administrative AJAX handlers exposed by the plugin. When an attacker constructs requests targeting specific subscriber IDs that do not correspond to their own account ID, the application fails to return an appropriate access denied error or redirect. Instead, it processes the request and returns the full dataset associated with the targeted user's profile. This behavior aligns directly with CWE-639, which categorizes authorization issues where a user can act as another user due to insufficient enforcement of role-based or attribute-based controls. The lack of strict ownership verification means that any authenticated account on the site can potentially enumerate and extract data from all other subscriber accounts by iterating through sequential ID numbers in their requests.
The operational impact of this broken access control is severe, primarily concerning data privacy compliance and user trust. Organizations relying on WooCommerce for e-commerce operations are often subject to stringent regulatory frameworks such as GDPR or CCPA, which mandate strict controls over personal data processing and storage. The ability for one customer to view another's private information constitutes a significant breach of these regulations, potentially leading to legal liabilities, fines, and reputational damage. Furthermore, the exposed data can serve as valuable intelligence for subsequent attacks. For instance, knowing valid email addresses combined with purchase history allows attackers to craft highly targeted phishing campaigns or conduct credential stuffing attempts against other services where users may have reused passwords. It also facilitates social engineering attacks by providing context about a victim's purchasing habits and personal details.
In terms of threat modeling, this vulnerability maps closely to the MITRE ATT&CK technique T1078, specifically Valid Accounts, as it involves leveraging legitimate credentials to access unauthorized resources. Additionally, it relates to TA0006 (Discovery) within the Discovery tactic, where an adversary gathers information about other users and their privileges to expand their foothold or plan further exploitation. The ease of exploitation means that even non-technical attackers with basic knowledge of web request manipulation can exploit this flaw using simple tools like curl or browser developer consoles, making it a high-risk issue for any public-facing WooCommerce store running the affected plugin versions.
To mitigate this vulnerability, immediate action is required to update the MakeCommerce for WooCommerce plugin to version 4.1.1 or later, where these access control checks have been corrected. Developers should ensure that all API endpoints and AJAX handlers implement strict ownership verification logic, ensuring that the user ID associated with the current session matches the resource owner's ID before returning any data. Implementing robust input validation on both client-side and server-side is essential, but server-side enforcement remains the primary defense against such bypasses. Additionally, organizations should audit their WordPress installations for other plugins that may expose similar endpoints without proper authorization checks. Regular security audits and penetration testing focused on broken access control scenarios are recommended to identify and remediate similar flaws across the entire application stack before they can be exploited in a production environment.