CVE-2026-86850: CWE-862 Missing Authorization in SKU Error Fixer for WooCommerce
Description
The SKU Error Fixer for WooCommerce WordPress plugin up to version 1.0 has a missing authorization vulnerability in two AJAX actions. These actions do not perform capability or nonce checks and are accessible to unauthenticated users, allowing permanent deletion and disclosure of product variations classified as obsolete without any recoverable copy.
Affected software
SKU Error Fixer for WooCommerce
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86850 describes a missing authorization (CWE-862) vulnerability in the SKU Error Fixer for WooCommerce plugin through version 1.0. Two AJAX actions lack proper capability and nonce verification and are accessible to unauthenticated users. This flaw permits attackers to permanently delete product variations deemed obsolete and to disclose details of those variations, with no recovery option for the deleted data.
Potential Impact
Unauthenticated attackers can permanently delete product variations and access sensitive details of those variations without authorization. The deletion is irreversible, potentially causing data loss and operational disruption for WooCommerce stores using this plugin version.
Mitigation Recommendations
No patch or official fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict access to the affected AJAX endpoints if possible or disable the plugin to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-08T14:57:54.988Z
- State
- PUBLISHED
Threat ID: 6ac88e5f2cdf04f656344b9f
Added to database: 10/09/2026, 06:49:03 UTC
Last enriched: 10/09/2026, 07:03:33 UTC
Last updated: 10/09/2026, 07:08:15 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.