CVE-2026-61958 describes a Missing Authorization vulnerability in the License Manager for WooCommerce plugin by Saad Iqbal. The issue arises from improperly configured access control, allowing users with limited privileges to perform unauthorized actions. This affects versions up to and including 3.0.17. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity impact with network attack vector, low attack complexity, and requiring low privileges without user interaction. No vendor advisory or patch information is currently available, and no known exploits have been reported.

The vulnerability allows unauthorized modification or actions within the License Manager for WooCommerce plugin, potentially leading to integrity and availability impacts. Confidentiality impact is not indicated. The medium severity score reflects the potential for limited privilege escalation or unauthorized changes without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict user privileges carefully to minimize risk. Monitor for vendor updates regarding patches or official mitigations.