---
id: "CVE-2026-109926"
kind: "vulnerability"
aliases: ["CVE-2026-109926"]
title: "Productive Commerce WordPress plugin: missing capability check lets subscribers activate plugins"
severity: "medium"
cvss: 4.3
epss: 0.00193
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["auth-required", "open-registration-disabled"]
published_at: "2026-10-21T06:16:47+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:37:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109926", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-109926", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Productive Commerce WordPress plugin: missing capability check lets subscribers activate plugins

The Productive Commerce WordPress plugin before 1.1.49 has an AJAX action with no capability check, and it exposes the nonce that guards it on every admin page. Any logged-in user, including a subscriber, can use it to activate other Productive Commerce plugin versions already installed on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Productive Commerce plugin version in the WordPress admin Plugins screen or with `wp plugin get <plugin-slug> --field=version`
- Look for list of users with low privileges such as subscribers that can log in on the site, since the attacker needs an account

## Fix

- Update the Productive Commerce WordPress plugin to `1.1.49` or later
- Remove unused accounts with low privileges until the update is applied

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109926
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-109926

## From the sources

The Productive Commerce  WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce  WordPress plugin before 1.1.49 already installed on the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_