Live › vulnerability › CVE-2026-109926
Go to dashboardThe Productive Commerce WordPress plugin before 1.1.49 has an AJAX action with no capability check, and it exposes the nonce that guards it on every admin page. Any logged-in user, including a subscriber, can use it to activate other Productive Commerce plugin versions already installed on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Productive Commerce WordPress plugin before 1.1.49 that allow any user to register or log in, since any authenticated account can reach the vulnerable AJAX action. Sites with no open registration and no shared low-privilege accounts face much less risk, and sites already on 1.1.49 or later are not affected.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version1.1.49 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-109926")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.