CVE-2026-12736: CWE-269 Improper Privilege Management in wpify WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce
The WPify Woo plugin for WordPress versions up to and including 5.4.16 contains a privilege escalation vulnerability. This arises because the plugin's REST API endpoint for saving options does not restrict which options can be updated nor sanitize their values, while only requiring the manage_woocommerce capability. As a result, authenticated users with Shop Manager-level access or higher can overwrite critical WordPress options, potentially elevating their privileges to Administrator or disabling security plugins.
AI Analysis
Technical Summary
CVE-2026-12736 is a privilege escalation vulnerability in the WPify Woo plugin for WordPress, affecting versions up to 5.4.16. The vulnerability exists in the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option), which accepts 'option' and 'data' parameters from the request and passes them directly to WordPress's update_option() function without an allowlist or sanitization. The permission check only verifies the manage_woocommerce capability, which is granted to Shop Manager roles and above. This flaw allows attackers with Shop Manager privileges to modify arbitrary WordPress options, such as setting the default user role to administrator or enabling user registration, thereby escalating their privileges to Administrator or disabling security plugins.
Potential Impact
An authenticated attacker with Shop Manager-level access or higher can exploit this vulnerability to escalate their privileges to Administrator by overwriting arbitrary WordPress options. This can lead to full site compromise, including the ability to create new administrator accounts, disable security plugins, and control site configuration.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Shop Manager-level access to trusted users only. Monitor for updates from the vendor and apply any official patches or temporary fixes once released.
CVE-2026-12736: CWE-269 Improper Privilege Management in wpify WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce
Description
The WPify Woo plugin for WordPress versions up to and including 5.4.16 contains a privilege escalation vulnerability. This arises because the plugin's REST API endpoint for saving options does not restrict which options can be updated nor sanitize their values, while only requiring the manage_woocommerce capability. As a result, authenticated users with Shop Manager-level access or higher can overwrite critical WordPress options, potentially elevating their privileges to Administrator or disabling security plugins.
CVSS v3.1
Score 8.0high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12736 is a privilege escalation vulnerability in the WPify Woo plugin for WordPress, affecting versions up to 5.4.16. The vulnerability exists in the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option), which accepts 'option' and 'data' parameters from the request and passes them directly to WordPress's update_option() function without an allowlist or sanitization. The permission check only verifies the manage_woocommerce capability, which is granted to Shop Manager roles and above. This flaw allows attackers with Shop Manager privileges to modify arbitrary WordPress options, such as setting the default user role to administrator or enabling user registration, thereby escalating their privileges to Administrator or disabling security plugins.
Potential Impact
An authenticated attacker with Shop Manager-level access or higher can exploit this vulnerability to escalate their privileges to Administrator by overwriting arbitrary WordPress options. This can lead to full site compromise, including the ability to create new administrator accounts, disable security plugins, and control site configuration.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Shop Manager-level access to trusted users only. Monitor for updates from the vendor and apply any official patches or temporary fixes once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-19T16:24:48.590Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a62de069c2644c7f835c481
Added to database: 07/24/2026, 03:37:42 UTC
Last enriched: 07/24/2026, 03:52:00 UTC
Last updated: 07/24/2026, 04:54:42 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.