CVE-2026-91009: CWE-862 Missing Authorization in Active Woot Products Tables for WooCommerce. 100% FREE
Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin versions 2.1.2 up to but not including 2.1.3 lack authorization and CSRF checks in some AJAX actions. This allows any authenticated user, including those with low privileges such as subscribers, to change the title of arbitrary posts, pages, and products.
AI Analysis
Technical Summary
The vulnerability identified as CVE-2026-91009 affects the Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before version 2.1.3. It is caused by missing authorization and Cross-Site Request Forgery (CSRF) protections in certain AJAX actions. This flaw permits any authenticated user, regardless of their role, to modify the titles of posts, pages, and products arbitrarily. The affected versions are >=2.1.2 and <2.1.3.
Potential Impact
An attacker with any authenticated user account, including low-privilege roles such as subscriber, can change the titles of arbitrary posts, pages, and products. This could lead to content manipulation, misinformation, or defacement within the affected WordPress site. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the ability to modify titles.
Mitigation Recommendations
Upgrade the Active Woot Products Tables for WooCommerce. 100% FREE plugin to version 2.1.3 or later where this vulnerability is fixed. Since the vulnerability is due to missing authorization and CSRF checks, applying the official update will remediate the issue. No other mitigations are specified.
CVE-2026-91009: CWE-862 Missing Authorization in Active Woot Products Tables for WooCommerce. 100% FREE
Description
Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin versions 2.1.2 up to but not including 2.1.3 lack authorization and CSRF checks in some AJAX actions. This allows any authenticated user, including those with low privileges such as subscribers, to change the title of arbitrary posts, pages, and products.
Affected software
Active Woot Products Tables for WooCommerce. 100% FREE
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2026-91009 affects the Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before version 2.1.3. It is caused by missing authorization and Cross-Site Request Forgery (CSRF) protections in certain AJAX actions. This flaw permits any authenticated user, regardless of their role, to modify the titles of posts, pages, and products arbitrarily. The affected versions are >=2.1.2 and <2.1.3.
Potential Impact
An attacker with any authenticated user account, including low-privilege roles such as subscriber, can change the titles of arbitrary posts, pages, and products. This could lead to content manipulation, misinformation, or defacement within the affected WordPress site. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the ability to modify titles.
Mitigation Recommendations
Upgrade the Active Woot Products Tables for WooCommerce. 100% FREE plugin to version 2.1.3 or later where this vulnerability is fixed. Since the vulnerability is due to missing authorization and CSRF checks, applying the official update will remediate the issue. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-14T16:11:02.393Z
- State
- PUBLISHED
Threat ID: 6aab827755bf5e2cf5d4d335
Added to database: 09/17/2026, 06:02:31 UTC
Last enriched: 09/17/2026, 06:16:53 UTC
Last updated: 09/17/2026, 06:39:53 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.