WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint

Wordfence Intelligence   >   Vulnerability Database   >   WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
8.0
Improper Privilege Management
CVE CVE-2026-12736
CVSS 8.0 (High)
Publicly Published July 23, 2026
Last Updated July 24, 2026
Researcher Wordfence PRISM - Wordfence

Description

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).

References

Share

Vulnerability Details for WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce

WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce

Software Type Plugin
Software Slug wpify-woo (view on wordpress.org)
Patched? Yes
Remediation Update to version 5.4.17, or a newer patched version
Affected Version
  • <= 5.4.16
Patched Version
  • 5.4.17

Recent vulnerabilities in WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce

WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce <= 5.4.1 - Authenticated (Contributor+) Arbitrary File Upload
8.8
CVE-2026-42748
May 29, 2026
Researcher: kai63001
WPify Woo Czech <= 4.0.10 - Reflected Cross-Site Scripting
6.1
CVE-2024-33946
Apr 30, 2024
Researcher: Dimas Maulana
WPify Woo Czech <= 4.0.8 - Missing Authorization
5.3
CVE-2024-1492
Feb 19, 2024
Researcher: Francesco Carlucci
WPify Woo Czech <= 3.5.6 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
May 16, 2022
Researcher: WPScanTeam
# Title CVE ID CVSS Researchers Date
1 WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce <= 5.4.1 - Authenticated (Contributor+) Arbitrary File Upload CVE-2026-42748 8.8 kai63001 May 29, 2026
2 WPify Woo Czech <= 4.0.10 - Reflected Cross-Site Scripting CVE-2024-33946 6.1 Dimas Maulana April 30, 2024
3 WPify Woo Czech <= 4.0.8 - Missing Authorization CVE-2024-1492 5.3 Francesco Carlucci February 19, 2024
4 WPify Woo Czech <= 3.5.6 - Reflected Cross-Site Scripting 6.1 WPScanTeam May 16, 2022
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation