CVE-2026-86785

Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.

Affected

Social Commerce for WooCommerce

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.18% chance of exploitation in the next 30 days, 7th percentile

Published

2026-09-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9a4c36bd-c7f7-4068-ac73-b29ee66def96/

References

• CVE Record
• NVD entry