CVE-2026-109926 PUBLISHED

Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation

Assigner: WPScan
Reserved: 13.10.2026 Published: 21.10.2026 Updated: 21.10.2026

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.

Product Status

Vendor Unknown
Product Productive Commerce
Versions Default: unaffected
  • affected from 0 to 1.1.49 (excl.)

Credits

  • Daniel Dhaniswara finder
  • WPScan coordinator

References

Problem Types

  • CWE-862 Missing Authorization CWE