WPify Woo <= 5.4.16 Privilege Escalation via Arbitrary Option Update (CVE-2026-12736)

Vulnerability Overview Vulnerability Name: WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint CVE ID: CVE-2026-12736 CVSS Score: 8.0 (High) Publish Date: July 23, 2026 Last Updated Date: July 24, 2026 Researcher: Wordfence PRISM - Wordfence Impact Scope Affected Versions: <= 5.4.16 Fixed Version: 5.4.17 Vulnerability Type: Improper Privilege Management CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Remediation Remediation Method: Update to version 5.4.17 or later Vulnerability Description Description: The WPify Woo plugin contains a privilege escalation vulnerability in versions 5.4.16 and earlier. This vulnerability exists because the REST route (POST /wp-json/wpify-woo/v1/option) does not perform any whitelisting of option names or validation of option data values provided in the request when updating options. The only verifies the capability. This allows an authenticated attacker with Shop Manager-level access to escalate their privileges to Administrator by overriding arbitrary WordPress options (e.g., setting to and to , or disabling security plugins via ). References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: wpify-woo Is Fixed: Yes Affected Versions: <= 5.4.16 Fixed Version: 5.4.17 Recent Vulnerabilities WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce <= 5.4.1 - Authenticated (Contributor+) Arbitrary File Upload - CVE ID: CVE-2026-42748 - CVSS Score: 8.8 - Researcher: kae63001 - Date: May 29, 2026 WPify Woo <= 4.0.10 - Reflected Cross-Site Scripting - CVE ID: CVE-2024-33946 - CVSS Score: 6.1 - Researcher: Dimas Maulana - Date: April 30, 2024 WPify Woo Czech <= 4.0.8 - Missing Authorization - CVE ID: CVE-2024-1492 - CVSS Score: 5.3 - Researcher: Francesco Carlucci - Date: February 19, 2024 WPify Woo Czech <= 3.5.6 - Reflected Cross-Site Scripting - CVE ID: CVE-2024-1492 - CVSS Score: 6.1 - Researcher: WPScanTeam - Date: May 16, 2022 Summary Vulnerability Overview: WPify Woo plugin versions 5.4.16 and earlier contain a privilege escalation vulnerability that can be achieved via arbitrary option updates. Impact Scope: Affected versions are <= 5.4.16; the fixed version is 5.4.17. Remediation: Update to version 5.4.17 or later.

Goal Reached Thanks to every supporter — we hit 100%!

WPify Woo <= 5.4.16 Privilege Escalation via Arbitrary Option Update (CVE-2026-12736)