{"id":"CVE-2026-116856","kind":"vulnerability","aliases":["CVE-2026-116856"],"related":[],"title":"WordPress WooCommerce plugin: missing authorization check exposes restricted actions","description":"Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.24.","summary":"Flexible Quantity – Measurement Price Calculator for WooCommerce, a WordPress plugin, is missing an authorization check, so some actions are not properly restricted to authorized users. The sources do not state exactly which action an attacker can perform or what data they gain.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flexible-quantity","package","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of Flexible Quantity – Measurement Price Calculator for WooCommerce in the WordPress admin plugin list, looking for `2.3.24` or older.","fix":"- Move the plugin to a version newer than `2.3.24`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-29T15:17:20+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","triaged_at":"2026-10-29T15:26:58+00:00","updated_at":"2026-10-29T15:26:58+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-29T15:26:58Z","model":"claude-haiku-5-5","output":{"fix":"- Move the plugin to a version newer than `2.3.24`; the sources do not name the exact fixed version.","reach":"internet","title":"WordPress WooCommerce plugin: missing authorization check exposes restricted actions","impact":"medium","summary":"Flexible Quantity – Measurement Price Calculator for WooCommerce, a WordPress plugin, is missing an authorization check, so some actions are not properly restricted to authorized users. The sources do not state exactly which action an attacker can perform or what data they gain.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","flexible-quantity"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted plugin actions on the store","analyst_note":"Check the NVD entry and the WP Desk changelog for the fixed version and the exact unauthorized action.","how_to_check":"- Check the installed version of Flexible Quantity – Measurement Price Calculator for WooCommerce in the WordPress admin plugin list, looking for `2.3.24` or older.\n- unknown for any other check; the sources do not say which setting or file is involved.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WooCommerce add-on Flexible Quantity – Measurement Price Calculator at version 2.3.24 or older are affected. The sources do not say which configuration or user role is needed to trigger the flaw, so teams without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4172,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116856':12A,15A '-2026':11A,14A '2.3.24':105C 'access':89C 'action':9A,39B,54B 'affect':94C 'allow':85C 'attack':56B 'author':5A,35B,45B,65C 'calcul':26B,74C,82C,99C 'check':6A,36B 'configur':88C 'control':90C 'cve':10A,13A 'data':61B 'desk':69C 'exact':52B 'exploit':86C 'expos':7A 'flexibl':17B,22B,70C,78C,95C 'flexible-quant':16B 'flexible-quantity-measurement-price-calculator-for-woocommerc':77C 'gain':63B 'incorrect':87C 'issu':93C 'levels.this':92C 'measur':24B,72C,80C,97C 'miss':4A,33B,64C 'n/a':103C 'packag':19B 'perform':58B 'plugin':3A,31B 'price':25B,73C,81C,98C 'proper':42B 'quantiti':18B,23B,71C,79C,96C 'restrict':8A,43B 'secur':91C 'sourc':48B 'state':51B 'user':46B 'vulner':66C 'woocommerc':2A,20B,28B,76C,84C,101C 'wordpress':1A,21B,30B 'wp':68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WooCommerce add-on Flexible Quantity – Measurement Price Calculator at version 2.3.24 or older are affected. The sources do not say which configuration or user role is needed to trigger the flaw, so teams without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116856","severity":null,"published_at":"2026-10-29T15:17:20+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","fetched_at":"2026-10-29T15:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}