CVE-2026-48888— WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
Quick assessment
Affected
Automattic WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Automattic WooCommerce 中的“资源分配无限制或无节流”漏洞会导致 HTTP 拒绝服务（DoS）攻击。 该问题影响 WooCommerce：从早期版本到 11.1.0 之前。
Possible ATT&CK Techniques 2 AI
T1499 · Endpoint Denial of Service T1498 · Network Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-48888
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.
This issue affects WooCommerce: from n/a before 11.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Automattic | WooCommerce | n/a ~ 11.1.0 | - |
|
II. Public POCs for CVE-2026-48888
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48888
请登录查看更多情报信息。
Vendor Pages for CVE-2026-48888 (1)
IV. Related Vulnerabilities
Same product: WooCommerce
-
CVE-2026-57777
WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerab -
CVE-2022-50972
WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-bo -
CVE-2026-3589
WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSR -
CVE-2025-15033
WooCommerce - Subscriber/Customer+ Order Data Disclosure -
CVE-2023-7320
WooCommerce <= 7.8.2 - Sensitive Information Exposure
Same vendor: Automattic
-
CVE-2026-57777
WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerab -
CVE-2026-73562
Mongoose: Prototype pollution in the update casting via __pr -
CVE-2026-42334
Mongoose: Improper Sanitization of $nor in sanitizeFilter Ma -
CVE-2026-3589
WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSR -
CVE-2026-22356
WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion
Same weakness: CWE-770
-
CVE-2026-62649
Reyrolle 7SR5 <2.70 未认证拒绝服务漏洞 -
CVE-2026-86513
java-json-tools jackson-coreutils JSON Pointer parser TreePo -
CVE-2026-75808
ASUS Armoury Crate资源分配无限制致本地拒绝服务 -
CVE-2026-82753
Unauthenticated authorize requests create unbounded, never-e -
CVE-2025-52657
HCL MyXalytics is affected by multiple security vulnerabilit
V. Comments for CVE-2026-48888
No comments yet