Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-86850— SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion

Quick assessment

Affected
Unknown SKU Error Fixer for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WooCommerce 的 SKU 错误修复器（SKU Error Fixer for WooCommerce）WordPress 插件（版本 1.0 及更早版本）在其两个 AJAX 操作中未进行任何权限（capability）或随机数（nonce）检查，且这些操作允许未认证的用户访问。这导致攻击者可以永久删除该插件标记为“过时”的产品变体（product variations），并泄露这些变体的详细信息，且不会留下任何可恢复的备份副本。

AI Predicted 7.5 Difficulty: Easy EPSS 0.14% · P3

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown SKU Error Fixer for WooCommerce ≤ 1.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86850

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown SKU Error Fixer for WooCommerce 0 ~ 1.0 -

II. Public POCs for CVE-2026-86850

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86850

请登录查看更多情报信息。

Other References for CVE-2026-86850 (1)

Same Patch Batch · Unknown · 2026-10-09 · 16 CVEs total

CVE-2026-89235 6.8 MEDIUM Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter
CVE-2026-86851 6.5 MEDIUM Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection &
CVE-2026-103329 5.3 MEDIUM Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signatu
CVE-2026-87846 5.3 MEDIUM Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion
CVE-2026-84220 4.8 MEDIUM Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection
CVE-2026-85348 4.3 MEDIUM GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF
CVE-2026-84224 4.1 MEDIUM Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
CVE-2026-106095 Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via upd
CVE-2026-106097 Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Creden
CVE-2026-93548 FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation
CVE-2026-87841 UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook
CVE-2026-92990 SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded T
CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update
CVE-2025-15700 AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import
CVE-2026-92989 SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing

IV. Related Vulnerabilities

Same vendor: Unknown

V. Comments for CVE-2026-86850

No comments yet

Leave a comment