---
id: "CVE-2026-118072"
kind: "vulnerability"
aliases: ["CVE-2026-118072"]
title: "WordPress fraud plugin lets subscribers blacklist customers from orders"
severity: "medium"
cvss: null
epss: 0.00132
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["easy-digital-downloads", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["plugin-at-2.3.6-or-later", "registration-closed"]
published_at: "2026-10-30T06:16:46+00:00"
first_seen_at: "2026-10-30T06:28:39+00:00"
updated_at: "2026-10-30T18:23:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118072", "first_seen_at": "2026-10-30T06:28:39+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-118072", "first_seen_at": "2026-10-30T18:23:38+00:00"}]
---

# WordPress fraud plugin lets subscribers blacklist customers from orders

The Fraud Prevention for WooCommerce and EDD WordPress plugin before 2.3.6 does not check whether a user may manage orders before adding a customer's details to the store's fraud blacklist. An account with the Subscriber role or higher can therefore block arbitrary legitimate customers from placing orders.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugins list or the plugin's main file header; affected if below `2.3.6`.
- Confirm whether the store runs WooCommerce or Easy Digital Downloads with this plugin active.

## Fix

- Fraud Prevention For WooCommerce and EDD: upgrade to `2.3.6` or later.

## Timeline

- 2026-10-30T06:28:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118072
- 2026-10-30T18:23:38+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-118072

## From the sources

The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_