{"id":"CVE-2026-3589","state":"PUBLISHED","title":"WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF","description":"The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.","publishedAt":"2026-03-06T09:11:10.949Z","updatedAt":"2026-03-06T17:44:58.613Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"WPScan","products":["Automattic WooCommerce"],"affected":[{"vendor":"Automattic","product":"WooCommerce","defaultStatus":"unaffected","versions":[{"version":"5.4.0","status":"affected","lessThan":"5.4.4","versionType":"semver"},{"version":"5.5.0","status":"affected","lessThan":"5.4.5","versionType":"semver"},{"version":"5.6.0","status":"affected","lessThan":"5.6.3","versionType":"semver"},{"version":"5.7.0","status":"affected","lessThan":"5.7.3","versionType":"semver"},{"version":"5.8.0","status":"affected","lessThan":"5.8.2","versionType":"semver"},{"version":"5.9.0","status":"affected","lessThan":"5.9.2","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThan":"6.0.2","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThan":"6.1.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThan":"6.2.3","versionType":"semver"},{"version":"6.3.0","status":"affected","lessThan":"6.3.2","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThan":"6.4.2","versionType":"semver"},{"version":"6.5.0","status":"affected","lessThan":"6.5.2","versionType":"semver"},{"version":"6.6.0","status":"affected","lessThan":"6.6.2","versionType":"semver"},{"version":"6.7.0","status":"affected","lessThan":"6.7.1","versionType":"semver"},{"version":"6.8.0","status":"affected","lessThan":"6.8.3","versionType":"semver"},{"version":"6.9.0","status":"affected","lessThan":"6.9.5","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThan":"7.0.2","versionType":"semver"},{"version":"7.1.0","status":"affected","lessThan":"7.1.2","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThan":"7.2.4","versionType":"semver"},{"version":"7.3.0","status":"affected","lessThan":"7.3.1","versionType":"semver"},{"version":"7.4.0","status":"affected","lessThan":"7.4.2","versionType":"semver"},{"version":"7.5.0","status":"affected","lessThan":"7.5.2","versionType":"semver"},{"version":"7.6.0","status":"affected","lessThan":"7.6.2","versionType":"semver"},{"version":"7.7.0","status":"affected","lessThan":"7.7.3","versionType":"semver"},{"version":"7.8.0","status":"affected","lessThan":"7.8.4","versionType":"semver"},{"version":"7.9.0","status":"affected","lessThan":"7.9.2","versionType":"semver"},{"version":"8.0.0","status":"affected","lessThan":"8.0.5","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThan":"8.1.4","versionType":"semver"},{"version":"8.2.0","status":"affected","lessThan":"8.2.5","versionType":"semver"},{"version":"8.3.0","status":"affected","lessThan":"8.3.4","versionType":"semver"},{"version":"8.4.0","status":"affected","lessThan":"8.4.3","versionType":"semver"},{"version":"8.5.0","status":"affected","lessThan":"8.5.5","versionType":"semver"},{"version":"8.6.0","status":"affected","lessThan":"8.6.4","versionType":"semver"},{"version":"8.7.0","status":"affected","lessThan":"8.7.3","versionType":"semver"},{"version":"8.8.0","status":"affected","lessThan":"8.8.7","versionType":"semver"},{"version":"8.9.0","status":"affected","lessThan":"8.9.5","versionType":"semver"},{"version":"9.0.0","status":"affected","lessThan":"9.0.4","versionType":"semver"},{"version":"9.1.0","status":"affected","lessThan":"9.1.7","versionType":"semver"},{"version":"9.2.0","status":"affected","lessThan":"9.2.5","versionType":"semver"},{"version":"9.3.0","status":"affected","lessThan":"9.3.6","versionType":"semver"},{"version":"9.4.0","status":"affected","lessThan":"9.4.5","versionType":"semver"},{"version":"9.5.0","status":"affected","lessThan":"9.5.4","versionType":"semver"},{"version":"9.6.0","status":"affected","lessThan":"9.6.4","versionType":"semver"},{"version":"9.7.0","status":"affected","lessThan":"9.7.3","versionType":"semver"},{"version":"9.8.0","status":"affected","lessThan":"9.8.7","versionType":"semver"},{"version":"9.9.0","status":"affected","lessThan":"9.9.7","versionType":"semver"},{"version":"10.0.0","status":"affected","lessThan":"10.0.6","versionType":"semver"},{"version":"10.1.0","status":"affected","lessThan":"10.1.4","versionType":"semver"},{"version":"10.2.0","status":"affected","lessThan":"10.2.4","versionType":"semver"},{"version":"10.3.0","status":"affected","lessThan":"10.3.8","versionType":"semver"},{"version":"10.4.0","status":"affected","lessThan":"10.4.4","versionType":"semver"},{"version":"10.5.0","status":"affected","lessThan":"10.5.3","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/","https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T20:11:50.837Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/3xxx/CVE-2026-3589.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-3589","state":"PUBLISHED","datePublished":"2026-03-06T09:11:10.949Z","dateUpdated":"2026-03-06T17:44:58.613Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2026-03-05T10:41:21.729Z"},"containers":{"cna":{"title":"WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF","descriptions":[{"lang":"en","value":"The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example."}],"affected":[{"vendor":"Automattic","product":"WooCommerce","defaultStatus":"unaffected","versions":[{"version":"5.4.0","status":"affected","lessThan":"5.4.4","versionType":"semver"},{"version":"5.5.0","status":"affected","lessThan":"5.4.5","versionType":"semver"},{"version":"5.6.0","status":"affected","lessThan":"5.6.3","versionType":"semver"},{"version":"5.7.0","status":"affected","lessThan":"5.7.3","versionType":"semver"},{"version":"5.8.0","status":"affected","lessThan":"5.8.2","versionType":"semver"},{"version":"5.9.0","status":"affected","lessThan":"5.9.2","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThan":"6.0.2","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThan":"6.1.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThan":"6.2.3","versionType":"semver"},{"version":"6.3.0","status":"affected","lessThan":"6.3.2","versionType":"semver"},{"version":"6.4.0","status":"affected","lessThan":"6.4.2","versionType":"semver"},{"version":"6.5.0","status":"affected","lessThan":"6.5.2","versionType":"semver"},{"version":"6.6.0","status":"affected","lessThan":"6.6.2","versionType":"semver"},{"version":"6.7.0","status":"affected","lessThan":"6.7.1","versionType":"semver"},{"version":"6.8.0","status":"affected","lessThan":"6.8.3","versionType":"semver"},{"version":"6.9.0","status":"affected","lessThan":"6.9.5","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThan":"7.0.2","versionType":"semver"},{"version":"7.1.0","status":"affected","lessThan":"7.1.2","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThan":"7.2.4","versionType":"semver"},{"version":"7.3.0","status":"affected","lessThan":"7.3.1","versionType":"semver"},{"version":"7.4.0","status":"affected","lessThan":"7.4.2","versionType":"semver"},{"version":"7.5.0","status":"affected","lessThan":"7.5.2","versionType":"semver"},{"version":"7.6.0","status":"affected","lessThan":"7.6.2","versionType":"semver"},{"version":"7.7.0","status":"affected","lessThan":"7.7.3","versionType":"semver"},{"version":"7.8.0","status":"affected","lessThan":"7.8.4","versionType":"semver"},{"version":"7.9.0","status":"affected","lessThan":"7.9.2","versionType":"semver"},{"version":"8.0.0","status":"affected","lessThan":"8.0.5","versionType":"semver"},{"version":"8.1.0","status":"affected","lessThan":"8.1.4","versionType":"semver"},{"version":"8.2.0","status":"affected","lessThan":"8.2.5","versionType":"semver"},{"version":"8.3.0","status":"affected","lessThan":"8.3.4","versionType":"semver"},{"version":"8.4.0","status":"affected","lessThan":"8.4.3","versionType":"semver"},{"version":"8.5.0","status":"affected","lessThan":"8.5.5","versionType":"semver"},{"version":"8.6.0","status":"affected","lessThan":"8.6.4","versionType":"semver"},{"version":"8.7.0","status":"affected","lessThan":"8.7.3","versionType":"semver"},{"version":"8.8.0","status":"affected","lessThan":"8.8.7","versionType":"semver"},{"version":"8.9.0","status":"affected","lessThan":"8.9.5","versionType":"semver"},{"version":"9.0.0","status":"affected","lessThan":"9.0.4","versionType":"semver"},{"version":"9.1.0","status":"affected","lessThan":"9.1.7","versionType":"semver"},{"version":"9.2.0","status":"affected","lessThan":"9.2.5","versionType":"semver"},{"version":"9.3.0","status":"affected","lessThan":"9.3.6","versionType":"semver"},{"version":"9.4.0","status":"affected","lessThan":"9.4.5","versionType":"semver"},{"version":"9.5.0","status":"affected","lessThan":"9.5.4","versionType":"semver"},{"version":"9.6.0","status":"affected","lessThan":"9.6.4","versionType":"semver"},{"version":"9.7.0","status":"affected","lessThan":"9.7.3","versionType":"semver"},{"version":"9.8.0","status":"affected","lessThan":"9.8.7","versionType":"semver"},{"version":"9.9.0","status":"affected","lessThan":"9.9.7","versionType":"semver"},{"version":"10.0.0","status":"affected","lessThan":"10.0.6","versionType":"semver"},{"version":"10.1.0","status":"affected","lessThan":"10.1.4","versionType":"semver"},{"version":"10.2.0","status":"affected","lessThan":"10.2.4","versionType":"semver"},{"version":"10.3.0","status":"affected","lessThan":"10.3.8","versionType":"semver"},{"version":"10.4.0","status":"affected","lessThan":"10.4.4","versionType":"semver"},{"version":"10.5.0","status":"affected","lessThan":"10.5.3","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/","tags":["technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2026-03-06T09:11:10.949Z"},"credits":[{"lang":"en","value":"oolongeya","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-03-06T17:44:54.283745Z","id":"CVE-2026-3589","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","type":"CWE","lang":"en","description":"CWE-352 Cross-Site Request Forgery (CSRF)"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-06T17:44:58.613Z"}}]}}}