{"id":"CVE-2026-115431","kind":"vulnerability","aliases":["CVE-2026-115431"],"related":[],"title":"WooCommerce upsell plugin: missing authorization check lets users skip access controls","description":"Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.","summary":"Upsell Order Bump Offer for WooCommerce, a WordPress plugin by WP Swings, is missing an authorization check on some functionality. The sources say an attacker can exploit incorrectly configured access control to act beyond their permissions.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"upsell-order-bump-offer-for-woocommerce","fixed":["3.1.7"],"affected":"<= 3.1.6","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","plugin","woocommerce","wordpress","wp-swings"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin, Plugins > Installed Plugins: find 'Upsell Funnel Builder for WooCommerce' / slug upsell-order-bump-offer-for-woocommerce. Versions 3.1.6 and earlier are affected; 3.1.7 is the patched version per Patchstack. Or run: wp plugin get upsell-order-bump-offer-for-woocommerce --field=version","fix":"Update Upsell Order Bump Offer for WooCommerce (now named Upsell Funnel Builder for WooCommerce) to 3.1.7 or later","status":"open","published_at":"2026-11-06T13:17:25+00:00","first_seen_at":"2026-11-06T13:42:19+00:00","triaged_at":"2026-11-06T13:43:12+00:00","updated_at":"2026-11-06T13:44:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T13:43:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WooCommerce upsell plugin: missing authorization check lets users skip access controls","impact":"medium","summary":"Upsell Order Bump Offer for WooCommerce, a WordPress plugin by WP Swings, is missing an authorization check on some functionality. The sources say an attacker can exploit incorrectly configured access control to act beyond their permissions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wp-swings"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown actions exposed beyond intended permissions on the store","analyst_note":"Find the vendor advisory or the Wordfence/WP Scan record for the plugin to confirm the affected actions, required privilege, and the fixed version.","how_to_check":"- Check whether the `upsell-order-bump-offer-for-woocommerce` plugin is installed and its version in the WordPress admin under Plugins.\n- Compare the installed version against 3.1.6; versions through `3.1.6` are listed as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Stores running WordPress with WooCommerce and the Upsell Order Bump Offer for WooCommerce plugin at version 3.1.6 or earlier. The sources do not say what level of account is needed or which actions are exposed, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000707,"input_tokens":4244,"output_tokens":565,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or the Wordfence/WP Scan record for the plugin to confirm the affected actions, required privilege, and the fixed version.","search":"'-115431':14A,17A '-2026':13A,16A '3.1.6':106C 'access':10A,61B,91C 'act':64B 'affect':96C 'allow':87C 'attack':56B 'author':5A,47B,69C 'beyond':65B 'bump':21A,34B,76C,83C,99C 'check':6A,48B 'configur':60B,90C 'control':11A,62B,92C 'cve':12A,15A 'exploit':58B,88C 'for':23A 'function':51B 'incorrect':59B,89C 'issu':95C 'let':7A 'levels.this':94C 'miss':4A,45B,68C 'n/a':104C 'offer':22A,35B,77C,84C,100C 'order':20A,33B,75C,82C,98C 'packag':25B 'permiss':67B 'plugin':3A,26B,40B 'say':54B 'secur':93C 'skip':9A 'sourc':53B 'swing':31B,43B,73C 'upsel':2A,32B,74C,81C,97C 'upsell':19A 'upsell-order-bump-offer-for-woocommerc':80C 'upsell-order-bump-offer-for-woocommerce':18A 'user':8A 'vulner':70C 'woocommerc':1A,27B,37B,79C,86C,102C 'woocommerce':24A 'wordpress':28B,39B 'wp':30B,42B,72C 'wp-swing':29B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running WooCommerce with the WP Swings Upsell Order Bump Offer for WooCommerce plugin (also listed as Upsell Funnel Builder for WooCommerce) at 3.1.6 or earlier. It is a missing-authorization flaw (CWE-862); the CVSS vector indicates a low-privileged account is needed (PR:L), with limited integrity impact and high availability impact. Patchstack does not say which action is unprotected. A separate WPSec entry for the same version range describes Subscriber-level offer page creation and post content overwrite, but no source links it to this CVE. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["upsellorderbumpofferforwoocommerce"],"ptokens":["bump","for","offer","order","upsell","woocommerce"],"labels":["high","package","plugin","woocommerce","wordpress","wpswings"],"campaign_type":null,"search_a":"'-115431':14A,17A '-2026':13A,16A 'access':10A 'author':5A 'bump':21A 'check':6A 'control':11A 'cve':12A,15A 'for':23A 'let':7A 'miss':4A 'offer':22A 'order':20A 'plugin':3A 'skip':9A 'upsel':2A 'upsell':19A 'upsell-order-bump-offer-for-woocommerce':18A 'user':8A 'woocommerc':1A 'woocommerce':24A","search_b":"'access':61B 'act':64B 'attack':56B 'author':47B 'beyond':65B 'bump':34B 'check':48B 'configur':60B 'control':62B 'exploit':58B 'function':51B 'incorrect':59B 'miss':45B 'offer':35B 'order':33B 'packag':25B 'permiss':67B 'plugin':26B,40B 'say':54B 'sourc':53B 'swing':31B,43B 'upsel':32B 'woocommerc':27B,37B 'wordpress':28B,39B 'wp':30B,42B 'wp-swing':29B","search_c":"'3.1.6':106C 'access':91C 'affect':96C 'allow':87C 'author':69C 'bump':76C,83C,99C 'configur':90C 'control':92C 'exploit':88C 'incorrect':89C 'issu':95C 'levels.this':94C 'miss':68C 'n/a':104C 'offer':77C,84C,100C 'order':75C,82C,98C 'secur':93C 'swing':73C 'upsel':74C,81C,97C 'upsell-order-bump-offer-for-woocommerc':80C 'vulner':70C 'woocommerc':79C,86C,102C 'wp':72C","first_public_at":"2026-11-06T13:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115431","severity":null,"published_at":"2026-11-06T13:17:25+00:00","modified_at":"2026-11-06T13:17:25+00:00","first_seen_at":"2026-11-06T13:42:19+00:00","fetched_at":"2026-11-06T13:42:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115431:1893","url":"https://patchstack.com/database/wordpress/plugin/upsell-order-bump-offer-for-woocommerce/vulnerability/wordpress-upsell-order-bump-offer-for-woocommerce-plugin-3-1-6-broken-access-control-vulnerability","severity":null,"published_at":"2026-11-06T13:44:07+00:00","modified_at":"2026-11-06T13:44:07+00:00","first_seen_at":"2026-11-06T13:44:07+00:00","fetched_at":"2026-11-06T13:44:07+00:00","note":"Patchstack (CVE CNA) lists <=3.1.6, patched 3.1.7, reported by zhugez 19 Oct, published 4 Nov 2026; no exploitation reported. Primary vendor advisory/changelog not read, so nothing marked verified. Exact vulnerable action not stated; possible overlap with WPSEC-2026-2281 (Subscriber+ missing auth, fixed 3.1.7) is unconfirmed.","cites":["https://patchstack.com/database/wordpress/plugin/upsell-order-bump-offer-for-woocommerce/vulnerability/wordpress-upsell-order-bump-offer-for-woocommerce-plugin-3-1-6-broken-access-control-vulnerability","https://wordpress.org/plugins/upsell-order-bump-offer-for-woocommerce/"]}],"documents":[{"id":86783,"url":"https://patchstack.com/database/wordpress/plugin/upsell-order-bump-offer-for-woocommerce/vulnerability/wordpress-upsell-order-bump-offer-for-woocommerce-plugin-3-1-6-broken-access-control-vulnerability","title":"Patchstack: Upsell Order Bump Offer for WooCommerce <= 3.1.6 Broken Access Control","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":86784,"url":"https://wordpress.org/plugins/upsell-order-bump-offer-for-woocommerce/","title":"Upsell Funnel Builder for WooCommerce (WP Swings) - WordPress.org","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}