CVE-2026-3589 PUBLISHED

WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

Assigner: WPScan
Reserved: 05.03.2026 Published: 06.03.2026 Updated: 06.03.2026

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.

Product Status

Vendor Automattic
Product WooCommerce
Versions Default: unaffected
  • affected from 5.4.0 to 5.4.4 (excl.)
  • affected from 5.5.0 to 5.4.5 (excl.)
  • affected from 5.6.0 to 5.6.3 (excl.)
  • affected from 5.7.0 to 5.7.3 (excl.)
  • affected from 5.8.0 to 5.8.2 (excl.)
  • affected from 5.9.0 to 5.9.2 (excl.)
  • affected from 6.0.0 to 6.0.2 (excl.)
  • affected from 6.1.0 to 6.1.3 (excl.)
  • affected from 6.2.0 to 6.2.3 (excl.)
  • affected from 6.3.0 to 6.3.2 (excl.)
  • affected from 6.4.0 to 6.4.2 (excl.)
  • affected from 6.5.0 to 6.5.2 (excl.)
  • affected from 6.6.0 to 6.6.2 (excl.)
  • affected from 6.7.0 to 6.7.1 (excl.)
  • affected from 6.8.0 to 6.8.3 (excl.)
  • affected from 6.9.0 to 6.9.5 (excl.)
  • affected from 7.0.0 to 7.0.2 (excl.)
  • affected from 7.1.0 to 7.1.2 (excl.)
  • affected from 7.2.0 to 7.2.4 (excl.)
  • affected from 7.3.0 to 7.3.1 (excl.)
  • affected from 7.4.0 to 7.4.2 (excl.)
  • affected from 7.5.0 to 7.5.2 (excl.)
  • affected from 7.6.0 to 7.6.2 (excl.)
  • affected from 7.7.0 to 7.7.3 (excl.)
  • affected from 7.8.0 to 7.8.4 (excl.)
  • affected from 7.9.0 to 7.9.2 (excl.)
  • affected from 8.0.0 to 8.0.5 (excl.)
  • affected from 8.1.0 to 8.1.4 (excl.)
  • affected from 8.2.0 to 8.2.5 (excl.)
  • affected from 8.3.0 to 8.3.4 (excl.)
  • affected from 8.4.0 to 8.4.3 (excl.)
  • affected from 8.5.0 to 8.5.5 (excl.)
  • affected from 8.6.0 to 8.6.4 (excl.)
  • affected from 8.7.0 to 8.7.3 (excl.)
  • affected from 8.8.0 to 8.8.7 (excl.)
  • affected from 8.9.0 to 8.9.5 (excl.)
  • affected from 9.0.0 to 9.0.4 (excl.)
  • affected from 9.1.0 to 9.1.7 (excl.)
  • affected from 9.2.0 to 9.2.5 (excl.)
  • affected from 9.3.0 to 9.3.6 (excl.)
  • affected from 9.4.0 to 9.4.5 (excl.)
  • affected from 9.5.0 to 9.5.4 (excl.)
  • affected from 9.6.0 to 9.6.4 (excl.)
  • affected from 9.7.0 to 9.7.3 (excl.)
  • affected from 9.8.0 to 9.8.7 (excl.)
  • affected from 9.9.0 to 9.9.7 (excl.)
  • affected from 10.0.0 to 10.0.6 (excl.)
  • affected from 10.1.0 to 10.1.4 (excl.)
  • affected from 10.2.0 to 10.2.4 (excl.)
  • affected from 10.3.0 to 10.3.8 (excl.)
  • affected from 10.4.0 to 10.4.4 (excl.)
  • affected from 10.5.0 to 10.5.3 (excl.)

Credits

  • oolongeya finder

References

Problem Types

  • CWE-352 Cross-Site Request Forgery (CSRF) CWE