{"id":"CVE-2026-109926","kind":"vulnerability","aliases":["CVE-2026-109926"],"related":[],"title":"Productive Commerce WordPress plugin: missing capability check lets subscribers activate plugins","description":"The Productive Commerce  WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce  WordPress plugin before 1.1.49 already installed on the site.","summary":"The Productive Commerce WordPress plugin before 1.1.49 has an AJAX action with no capability check, and it exposes the nonce that guards it on every admin page. Any logged-in user, including a subscriber, can use it to activate other Productive Commerce plugin versions already installed on the site.","severity":"medium","cvss":4.3,"epss":0.00193,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["auth-required","open-registration-disabled"],"how_to_check":"- Check the installed Productive Commerce plugin version in the WordPress admin Plugins screen or with `wp plugin get <plugin-slug> --field=version`\n- Look for list of users with low privileges such as subscribers that can log in on the site, since the attacker needs an account","fix":"- Update the Productive Commerce WordPress plugin to `1.1.49` or later\n- Remove unused accounts with low privileges until the update is applied","status":"open","published_at":"2026-10-21T06:16:47+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:37:44+00:00","updated_at":"2026-10-25T04:37:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:37:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Productive Commerce WordPress plugin to `1.1.49` or later\n- Remove unused accounts with low privileges until the update is applied","reach":"internet","title":"Productive Commerce WordPress plugin: missing capability check lets subscribers activate plugins","impact":"medium","summary":"The Productive Commerce WordPress plugin before 1.1.49 has an AJAX action with no capability check, and it exposes the nonce that guards it on every admin page. Any logged-in user, including a subscriber, can use it to activate other Productive Commerce plugin versions already installed on the site.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Any logged-in user can activate installed plugin versions on the site","analyst_note":"","how_to_check":"- Check the installed Productive Commerce plugin version in the WordPress admin Plugins screen or with `wp plugin get <plugin-slug> --field=version`\n- Look for list of users with low privileges such as subscribers that can log in on the site, since the attacker needs an account","needs_analyst":false,"not_affected_if":["auth-required","open-registration-disabled"],"who_is_affected":"Sites running the Productive Commerce WordPress plugin before 1.1.49 that allow any user to register or log in, since any authenticated account can reach the vulnerable AJAX action. Sites with no open registration and no shared low-privilege accounts face much less risk, and sites already on 1.1.49 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00063,"input_tokens":3376,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109926':14A,17A '-2026':13A,16A '1.1.49':32B,82C,124C 'action':36B,94C 'activ':10A,65B,117C 'admin':51B,105C 'admin-area':104C 'ajax':35B,93C 'allow':108C 'alreadi':71B,125C 'arbitrari':118C 'area':106C 'authent':110C 'capabl':6A,39B,87C 'check':7A,40B,88C 'commerc':2A,28B,68B,78C,120C 'cve':12A,15A 'everi':50B,103C 'expos':43B,96C 'guard':47B,100C 'host':21B 'includ':58B 'instal':72B,126C 'let':8A 'log':55B 'logged-in':54B 'miss':5A 'nonc':45B,98C 'one':90C 'packag':18B 'page':52B,107C 'perform':85C 'plugin':4A,11A,25B,30B,69B,80C,122C 'product':1A,27B,67B,77C,119C 'self':20B 'self-host':19B 'site':75B,129C 'subscrib':9A,60B,115C 'use':62B 'user':57B,111C 'version':70B 'wordpress':3A,22B,24B,29B,79C,121C 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Productive Commerce WordPress plugin before 1.1.49 that allow any user to register or log in, since any authenticated account can reach the vulnerable AJAX action. Sites with no open registration and no shared low-privilege accounts face much less risk, and sites already on 1.1.49 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109926","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109926","severity":null,"published_at":"2026-10-21T06:16:47+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-109926","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109926","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}