---
id: "CVE-2026-116856"
kind: "vulnerability"
aliases: ["CVE-2026-116856"]
title: "WordPress WooCommerce plugin: missing authorization check exposes restricted actions"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["flexible-quantity", "package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-29T15:17:20+00:00"
first_seen_at: "2026-10-29T15:25:39+00:00"
updated_at: "2026-10-29T15:26:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116856", "first_seen_at": "2026-10-29T15:25:39+00:00"}]
---

# WordPress WooCommerce plugin: missing authorization check exposes restricted actions

Flexible Quantity – Measurement Price Calculator for WooCommerce, a WordPress plugin, is missing an authorization check, so some actions are not properly restricted to authorized users. The sources do not state exactly which action an attacker can perform or what data they gain.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Flexible Quantity – Measurement Price Calculator for WooCommerce in the WordPress admin plugin list, looking for `2.3.24` or older.

## Fix

- Move the plugin to a version newer than `2.3.24`; the sources do not name the exact fixed version.

## Timeline

- 2026-10-29T15:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116856

## From the sources

Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.24.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_