Live › vulnerability › CVE-2026-118072
The Fraud Prevention for WooCommerce and EDD WordPress plugin before 2.3.6 does not check whether a user may manage orders before adding a customer's details to the store's fraud blacklist. An account with the Subscriber role or higher can therefore block arbitrary legitimate customers from placing orders.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 06:28 UTC. All times on this page are UTC.
Online stores running the Fraud Prevention for WooCommerce or EDD plugin before version 2.3.6 are exposed. Any site where users can register with the Subscriber role or higher is reachable by this flaw, so open-registration stores carry the most risk. Stores without this plugin or on 2.3.6 or later are not affected.
No product ranges from the sources yet.
2.3.6.2.3.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.
This page as .md · .json · in your agent: get_signal("CVE-2026-118072")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.