CVE-2026-39794

Summary

A WooCommerce Multivendor Marketplace REST API with broken access control allows unauthenticated users to access restricted data and functionality, potentially leading to unauthorized data exposure or manipulation.

Exploitability

Exploitation is straightforward with no prerequisites, as the vulnerability affects unauthenticated API endpoints that should require authentication.

Blast radius

The impact could be significant across multiple vendor accounts and their associated product listings, orders, and customer data in affected WooCommerce installations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.6.4 or later to address the broken access control vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.