CVE-2026-84849: CWE-290 Authentication Bypass by Spoofing in brightvesseldev Pre-Orders for WooCommerce

CVE-2026-84849 is classified as a CWE-290 Authentication Bypass by Spoofing vulnerability in the Pre-Orders for WooCommerce plugin developed by brightvesseldev. It affects versions up to and including 2.3. The vulnerability allows unauthenticated attackers to bypass authentication mechanisms, which could lead to limited confidentiality and integrity impacts without affecting availability. The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

The vulnerability allows unauthenticated attackers to bypass authentication controls, potentially exposing some confidential information and allowing limited unauthorized modifications. There is no impact on system availability. The overall impact is considered medium severity based on the CVSS score and described effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected plugin or disabling it if feasible.