{"id":"CVE-2026-118072","kind":"vulnerability","aliases":["CVE-2026-118072"],"related":[],"title":"WordPress fraud plugin lets subscribers blacklist customers from orders","description":"The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.","summary":"The Fraud Prevention for WooCommerce and EDD WordPress plugin before 2.3.6 does not check whether a user may manage orders before adding a customer's details to the store's fraud blacklist. An account with the Subscriber role or higher can therefore block arbitrary legitimate customers from placing orders.","severity":"medium","cvss":null,"epss":0.0017,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["easy-digital-downloads","package","self-hosted","woocommerce","wordpress"],"not_affected_if":["plugin-at-2.3.6-or-later","registration-closed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or the plugin's main file header; affected if below `2.3.6`.\n- Confirm whether the store runs WooCommerce or Easy Digital Downloads with this plugin active.","fix":"- Fraud Prevention For WooCommerce and EDD: upgrade to `2.3.6` or later.","status":"open","published_at":"2026-10-30T06:16:46+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","triaged_at":"2026-10-30T06:30:01+00:00","updated_at":"2026-11-01T04:46:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T06:30:01Z","model":"claude-haiku-5-5","output":{"fix":"- Fraud Prevention For WooCommerce and EDD: upgrade to `2.3.6` or later.","reach":"internet","title":"WordPress fraud plugin lets subscribers blacklist customers from orders","impact":"medium","summary":"The Fraud Prevention for WooCommerce and EDD WordPress plugin before 2.3.6 does not check whether a user may manage orders before adding a customer's details to the store's fraud blacklist. An account with the Subscriber role or higher can therefore block arbitrary legitimate customers from placing orders.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","easy-digital-downloads","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker blocks arbitrary legitimate customers from placing orders","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin plugins list or the plugin's main file header; affected if below `2.3.6`.\n- Confirm whether the store runs WooCommerce or Easy Digital Downloads with this plugin active.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-at-2.3.6-or-later","registration-closed"],"who_is_affected":"Online stores running the Fraud Prevention for WooCommerce or EDD plugin before version 2.3.6 are exposed. Any site where users can register with the Subscriber role or higher is reachable by this flaw, so open-registration stores carry the most risk. Stores without this plugin or on 2.3.6 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4136,"output_tokens":604,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118072':12A,15A '-2026':11A,14A '2.3.6':36B,85C 'account':59B 'add':47B,100C 'allow':93C,114C 'arbitrari':69B,124C 'blacklist':6A,57B,111C 'block':68B 'check':39B,88C 'could':113C 'custom':7A,49B,71B,104C,126C 'cve':10A,13A 'detail':51B,105C 'digit':18B 'download':19B 'easi':17B 'easy-digital-download':16B 'edd':32B,81C 'fraud':2A,27B,56B,76C,110C 'higher':65B 'host':23B 'legitim':70B,125C 'let':4A,98C 'manag':44B,95C 'may':43B 'order':9A,45B,74B,96C,102C,129C 'packag':20B 'place':73B,128C 'plugin':3A,34B,83C 'prevent':28B,77C,123C 'role':63B,119C 'self':22B 'self-host':21B 'store':54B,108C 'subscrib':5A,62B,118C 'therefor':67B 'user':42B,91C,115C 'whether':40B 'woocommerc':24B,30B,79C 'wordpress':1A,25B,33B,82C","nicknames":[],"mitigations":[],"who_affected":"Online stores running the Fraud Prevention for WooCommerce or EDD plugin before version 2.3.6 are exposed. Any site where users can register with the Subscriber role or higher is reachable by this flaw, so open-registration stores carry the most risk. Stores without this plugin or on 2.3.6 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118072","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118072","severity":null,"published_at":"2026-10-30T06:16:46+00:00","modified_at":"2026-10-30T06:16:46+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","fetched_at":"2026-10-30T06:28:39+00:00","note":null},{"source":"epss","external_id":"CVE-2026-118072","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118072","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T18:23:38+00:00","fetched_at":"2026-11-01T04:46:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}