CVE-2026-11364 is a missing authorization vulnerability (CWE-862) in the Product Specifications for WooCommerce plugin by dornaweb, affecting versions up to 0.8.9. The vulnerability is caused by the lack of capability checks and nonce verification in the __invoke() methods of AttributeGroupController and AttributeController classes, which handle the 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX actions. This allows authenticated users with low privileges (Subscriber-level and above) to create, edit, and delete arbitrary product specification groups and attributes (taxonomy terms), leading to unauthorized modification of business-critical data and impacting the site's frontend presentation.

An attacker with authenticated access at Subscriber level or higher can manipulate product specification groups and attributes without proper authorization. This unauthorized modification can corrupt business data and disrupt the frontend display of the affected WooCommerce site. There is no direct confidentiality or availability impact reported, but integrity of product specification data is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to product specification modifications. Avoid granting Subscriber-level or higher access to untrusted users. Follow vendor updates closely for an official patch or temporary workaround.