CVE-2026-106608

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://patchstack.com/database/wordpress/plugin/woocommerce/vulnerability/wordpress-woocommerce-plugin-9-8-0-11-1-2-privilege-escalation-vulnerability?_s_id=cve

Weakness type (CWE)

CWE-266

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://severitydaily.com/woocommerce-cve-2026-106608-shop-manager-array-intersect-9-8-0-floor-unchanged-6-0-0/

Full discourse1 post

Severity Daily@severitydaily1d
WooCommerce's new CVE says the shop-manager privilege escalation starts at 9.8.0. The same vulnerable role check is in 6.0.0, and the file is byte-identical in 9.7.0. No exploitation reported. https://severitydaily.com/woocommerce-cve-2026-106608-shop-manager-array-intersect-9-8-0-floor-unchanged-6-0-0/
0000033
33 followersView on X

Explore more

Back to dashboard