{"id":"CVE-2026-125801","kind":"vulnerability","aliases":["CVE-2026-125801"],"related":[],"title":"WooCommerce: race condition in shared resource handling enables exploitation","description":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic WooCommerce woocommerce allows Leveraging Race Conditions.This issue affects WooCommerce: from 11.0.0 through 11.2.2.","summary":"WooCommerce versions 11.0.0 through 11.2.2 contain a race condition, where concurrent requests access a shared resource without proper synchronization. The sources do not state what an attacker gains beyond the race itself.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","woocommerce","wordpress"],"not_affected_if":["version-outside-11.0.0-to-11.2.2"],"how_to_check":"- Check the installed WooCommerce version in the WordPress admin plugin list or in the plugin's main file header\n- Confirm whether the installed version is between `11.0.0` and `11.2.2`","fix":"- WooCommerce: move to a version later than `11.2.2` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-11-13T13:18:21+00:00","first_seen_at":"2026-11-13T13:46:51+00:00","triaged_at":"2026-11-13T13:47:57+00:00","updated_at":"2026-11-13T13:47:57+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-13T13:47:57Z","model":"claude-haiku-5-5","output":{"fix":"- WooCommerce: move to a version later than `11.2.2` (the sources do not name the exact fixed release)","reach":"internet","title":"WooCommerce: race condition in shared resource handling enables exploitation","impact":"medium","summary":"WooCommerce versions 11.0.0 through 11.2.2 contain a race condition, where concurrent requests access a shared resource without proper synchronization. The sources do not state what an attacker gains beyond the race itself.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","ecommerce"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; sources do not describe the outcome beyond the race condition","analyst_note":"Find the WooCommerce advisory or Wordfence entry for CVE-2026-125801 to confirm the fixed version, required auth and what the race exposes.","how_to_check":"- Check the installed WooCommerce version in the WordPress admin plugin list or in the plugin's main file header\n- Confirm whether the installed version is between `11.0.0` and `11.2.2`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-11.0.0-to-11.2.2"],"who_is_affected":"Sites running WooCommerce in the affected range are in scope, since the flaw is in the store plugin itself. The sources do not say which features or configurations make the race reachable, so teams should assume any WooCommerce site in range is exposed until the vendor's advisory says otherwise.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000753,"input_tokens":4550,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125801':12A,15A '-2026':11A,14A '11.0.0':22B,74C '11.2.2':24B,76C 'access':32B 'affect':71C 'allow':66C 'attack':46B 'automatt':63C 'beyond':48B 'concurr':30B,51C 'condit':3A,28B,60C 'conditions.this':69C 'contain':25B 'cve':10A,13A 'ecommerc':16B 'enabl':8A 'execut':52C 'exploit':9A 'gain':47B 'handl':7A 'improp':57C 'issu':70C 'leverag':67C 'packag':17B 'proper':37B 'race':2A,27B,50B,59C,68C 'request':31B 'resourc':6A,35B,55C 'share':5A,34B,54C 'sourc':40B 'state':43B 'synchron':38B,58C 'use':53C 'version':21B 'vulner':61C 'without':36B 'woocommerc':1A,18B,20B,64C,65C,72C 'wordpress':19B","nicknames":[],"mitigations":[],"who_affected":"Sites running WooCommerce in the affected range are in scope, since the flaw is in the store plugin itself. The sources do not say which features or configurations make the race reachable, so teams should assume any WooCommerce site in range is exposed until the vendor's advisory says otherwise.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ecommerce","medium","package","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-125801':12A,15A '-2026':11A,14A 'condit':3A 'cve':10A,13A 'enabl':8A 'exploit':9A 'handl':7A 'race':2A 'resourc':6A 'share':5A 'woocommerc':1A","search_b":"'11.0.0':22B '11.2.2':24B 'access':32B 'attack':46B 'beyond':48B 'concurr':30B 'condit':28B 'contain':25B 'ecommerc':16B 'gain':47B 'packag':17B 'proper':37B 'race':27B,50B 'request':31B 'resourc':35B 'share':34B 'sourc':40B 'state':43B 'synchron':38B 'version':21B 'without':36B 'woocommerc':18B,20B 'wordpress':19B","search_c":"'11.0.0':74C '11.2.2':76C 'affect':71C 'allow':66C 'automatt':63C 'concurr':51C 'condit':60C 'conditions.this':69C 'execut':52C 'improp':57C 'issu':70C 'leverag':67C 'race':59C,68C 'resourc':55C 'share':54C 'synchron':58C 'use':53C 'vulner':61C 'woocommerc':64C,65C,72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T13:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125801","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125801","severity":null,"published_at":"2026-11-13T13:18:21+00:00","modified_at":"2026-11-13T13:18:21+00:00","first_seen_at":"2026-11-13T13:46:51+00:00","fetched_at":"2026-11-13T13:46:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}