CVE-2026-125801 · Package
NO FIX YET · SEE WHAT TO DO
WooCommerce versions 11.0.0 through 11.2.2 contain a race condition, where concurrent requests access a shared resource without proper synchronization. The sources do not state what an attacker gains beyond the race itself.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running WooCommerce in the affected range are in scope, since the flaw is in the store plugin itself. The sources do not say which features or configurations make the race reachable, so teams should assume any WooCommerce site in range is exposed until the vendor's advisory says otherwise.
Not affected if version-outside-11.0.0-to-11.2.2
Who cares ecommerce, woocommerce, wordpress
11.0.0 and 11.2.211.2.2 (the sources do not name the exact fixed release)Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic WooCommerce woocommerce allows Leveraging Race Conditions.This issue affects WooCommerce: from 11.0.0 through 11.2.2.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.