CVE-2026-49110

Vulnerability

The vulnerability is an unauthenticated broken authentication issue in the Upsell Order Bump Offer for WooCommerce plugin for WordPress, affecting versions up to and including 3.1.4 [1]. Attackers can bypass authentication checks to perform actions that should be restricted to higher-privileged users, such as administrative functions.

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests to the affected plugin's endpoints, bypassing authentication checks [1]. No prior access, user interaction, or special network position is required.

Impact

Successful exploitation allows the attacker to execute actions normally restricted to higher-privileged users, potentially leading to full administrative control over the WordPress website [1]. This could result in data theft, site defacement, or further compromise.

Mitigation

The vulnerability is fixed in version 3.1.5 of the plugin [1]. Users are strongly advised to update immediately. If unable to update, consider enabling auto-updates for vulnerable plugins via Patchstack or similar service [1]. No known workarounds are available.