---
id: "CVE-2026-111835"
kind: "vulnerability"
aliases: ["CVE-2026-111835"]
title: "WooCommerce Swish plugin: missing authorization check exposes store functions"
severity: "medium"
cvss: 6.5
epss: 0.00217
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "swish", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-21T15:17:15+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:49:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111835", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111835", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# WooCommerce Swish plugin: missing authorization check exposes store functions

The BjornTech Swish for WooCommerce plugin has a missing authorization check, so access controls are not enforced on some functionality. An attacker may be able to perform actions they should not be allowed to, with the exact scope not stated in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version of `woo-swish-e-commerce` in the WordPress admin plugins list or with `wp plugin get woo-swish-e-commerce --field=version`
- unknown

## Fix

- Update BjornTech Swish for WooCommerce to a version later than `3.7.8`
- unknown

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111835
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111835

## From the sources

Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BjornTech Swish for WooCommerce: from n/a through 3.7.8.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_