Live › vulnerability › CVE-2026-54871
ShopBuilder, an Elementor and WooCommerce add-on for WordPress, has a missing authorization check that allows access controls to be bypassed. The sources do not say which actions an attacker can perform, but the flaw is rated medium severity (CVSS 5.3).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the ShopBuilder – Elementor WooCommerce Builder Addons plugin at version 3.4.2 or earlier are exposed. Sites without this plugin, or running a newer version than the sources list, are not affected. The sources do not describe any extra configuration that is needed for exploitation.
No product ranges from the sources yet.
wp plugin get shopbuilder --field=version if WP-CLI is in use.3.4.2 are listed as affected.3.4.2 are affected; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-54871")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.