{"id":"CVE-2026-111835","kind":"vulnerability","aliases":["CVE-2026-111835"],"related":[],"title":"WooCommerce Swish plugin: missing authorization check exposes store functions","description":"Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BjornTech Swish for WooCommerce: from n/a through 3.7.8.","summary":"The BjornTech Swish for WooCommerce plugin has a missing authorization check, so access controls are not enforced on some functionality. An attacker may be able to perform actions they should not be allowed to, with the exact scope not stated in the sources.","severity":"medium","cvss":6.5,"epss":0.00217,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","swish","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version of `woo-swish-e-commerce` in the WordPress admin plugins list or with `wp plugin get woo-swish-e-commerce --field=version`\n- unknown","fix":"- Update BjornTech Swish for WooCommerce to a version later than `3.7.8`\n- unknown","status":"open","published_at":"2026-10-21T15:17:15+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:49:04+00:00","updated_at":"2026-10-25T03:49:04+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T03:49:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update BjornTech Swish for WooCommerce to a version later than `3.7.8`\n- unknown","reach":"internet","title":"WooCommerce Swish plugin: missing authorization check exposes store functions","impact":"medium","summary":"The BjornTech Swish for WooCommerce plugin has a missing authorization check, so access controls are not enforced on some functionality. An attacker may be able to perform actions they should not be allowed to, with the exact scope not stated in the sources.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","swish","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown access control bypass on WooCommerce store functions","analyst_note":"Find the vendor advisory or the Wordfence/NVD entry for CVE-2026-111835 to confirm the affected functions, required privileges and the fixed version.","how_to_check":"- Check the installed plugin version of `woo-swish-e-commerce` in the WordPress admin plugins list or with `wp plugin get woo-swish-e-commerce --field=version`\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running BjornTech Swish for WooCommerce at version 3.7.8 or earlier are affected. The sources do not describe which configurations or roles are exposed, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000602,"input_tokens":3370,"output_tokens":530,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111835':12A,15A '-2026':11A,14A '3.7.8':97C 'abl':47B 'access':35B,84C 'action':50B 'affect':89C 'allow':55B,80C 'attack':44B 'author':5A,32B,67C 'bjorntech':24B,70C,71C,90C 'check':6A,33B 'commerc':79C 'configur':83C 'control':36B,85C 'cve':10A,13A 'e':78C 'enforc':39B 'exact':59B 'exploit':81C 'expos':7A 'function':9A,42B 'host':19B 'incorrect':82C 'issu':88C 'levels.this':87C 'may':45B 'miss':4A,31B,66C 'n/a':95C 'packag':16B 'perform':49B 'plugin':3A,28B 'scope':60B 'secur':86C 'self':18B 'self-host':17B 'sourc':65B 'state':62B 'store':8A 'swish':2A,20B,25B,72C,77C,91C 'vulner':68C 'woo':76C 'woo-swish-e-commerc':75C 'woocommerc':1A,21B,27B,74C,93C 'wordpress':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running BjornTech Swish for WooCommerce at version 3.7.8 or earlier are affected. The sources do not describe which configurations or roles are exposed, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T15:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111835","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111835","severity":null,"published_at":"2026-10-21T15:17:15+00:00","modified_at":"2026-10-21T18:19:16+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111835","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111835","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}