{"id":"CVE-2026-110376","kind":"vulnerability","aliases":["CVE-2026-110376"],"related":[],"title":"WooCommerce DEPART deposit plugin: missing authorization check through 1.0.10","description":"Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through 1.0.10.","summary":"The DEPART deposit and part-payment plugin for WooCommerce versions up to 1.0.10 has a missing authorization check. The sources do not say which actions an attacker can perform with it.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed DEPART plugin version in the WordPress admin under Plugins; versions through `1.0.10` are reported as affected.\n- unknown for other checks, the sources do not say.","fix":"- Update the DEPART plugin to a version later than `1.0.10`; the fixed version is not named in the sources.\n- unknown for other actions.","status":"open","published_at":"2026-10-26T09:16:34+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","triaged_at":"2026-10-26T09:31:05+00:00","updated_at":"2026-10-26T09:31:05+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T09:31:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the DEPART plugin to a version later than `1.0.10`; the fixed version is not named in the sources.\n- unknown for other actions.","reach":"internet","title":"WooCommerce DEPART deposit plugin: missing authorization check through 1.0.10","impact":"medium","summary":"The DEPART deposit and part-payment plugin for WooCommerce versions up to 1.0.10 has a missing authorization check. The sources do not say which actions an attacker can perform with it.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access-control bypass in a WooCommerce deposit plugin","analyst_note":"Find the vendor advisory or the NVD page to learn which actions lack the check, whether login is needed, and the fixed version.","how_to_check":"- Check the installed DEPART plugin version in the WordPress admin under Plugins; versions through `1.0.10` are reported as affected.\n- unknown for other checks, the sources do not say.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the DEPART deposit and part-payment plugin for WooCommerce at version 1.0.10 or earlier are affected. Sites without this plugin installed can skip it. The sources do not say whether the flaw needs a logged-in user or a particular setting.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000602,"input_tokens":3318,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110376':12A,15A '-2026':11A,14A '1.0.10':9A,35B,80C 'access':70C 'action':47B 'affect':75C 'allow':66C 'attack':49B 'author':6A,39B,53C 'check':7A,40B 'configur':69C 'control':71C 'cve':10A,13A 'depart':2A,23B,57C,59C,76C 'depart-deposit-and-part-payment-for-woo':58C 'deposit':3A,24B,60C 'exploit':67C 'host':19B 'incorrect':68C 'issu':74C 'levels.this':73C 'miss':5A,38B,52C 'n/a':78C 'packag':16B 'part':27B,62C 'part-pay':26B 'payment':28B,63C 'perform':51B 'plugin':4A,29B 'say':45B 'secur':72C 'self':18B 'self-host':17B 'sourc':42B 'version':32B 'villathem':56C 'vulner':54C 'woo':65C 'woocommerc':1A,20B,31B 'wordpress':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the DEPART deposit and part-payment plugin for WooCommerce at version 1.0.10 or earlier are affected. Sites without this plugin installed can skip it. The sources do not say whether the flaw needs a logged-in user or a particular setting.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110376","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110376","severity":null,"published_at":"2026-10-26T09:16:34+00:00","modified_at":"2026-10-26T09:16:34+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","fetched_at":"2026-10-26T09:29:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}