CVE-2026-61952 is a Missing Authorization vulnerability in the WooCommerce Bulk Edit Products – WP Sheet Editor plugin by Jose Vega. The flaw arises from incorrectly configured access control, allowing users with certain privileges to perform unauthorized actions that impact data integrity. The vulnerability affects all versions up to and including 1.8.21. The CVSS 3.1 base score is 4.9 (medium), with network attack vector, low attack complexity, high privileges required, no user interaction, and unchanged scope. No vendor advisory or patch information is currently available.

The vulnerability allows unauthorized modification of product data due to missing authorization checks, impacting data integrity. There is no impact on confidentiality or availability. Exploitation requires high privileges, limiting the attack surface to users with elevated access. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to users with high privileges and monitor for unusual activity related to bulk product editing. Avoid granting unnecessary permissions to reduce risk.