CVE-2026-12736: Wpify Woo Privilege Escalation Flaw

CVE-2026-12736 Overview

CVE-2026-12736 is a privilege escalation vulnerability in the Wpify Woo plugin for WordPress, affecting all versions up to and including 5.4.16. The flaw resides in the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option), which passes user-supplied option and data parameters directly to WordPress update_option() without an allowlist or sanitization. The permission_callback only checks the manage_woocommerce capability, so authenticated attackers holding Shop Manager or higher roles can overwrite arbitrary WordPress options. This weakness is classified under CWE-269: Improper Privilege Management.

Critical Impact
Authenticated Shop Manager accounts can escalate to Administrator by rewriting core WordPress options such as default_role, users_can_register, and active_plugins.

Affected Products

Wpify Woo plugin for WordPress, versions up to and including 5.4.16
WooCommerce sites where Shop Manager or higher roles are delegated to non-administrators
WordPress installations exposing the wpify-woo/v1/option REST endpoint

Discovery Timeline

2026-07-24 - CVE-2026-12736 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-12736

Vulnerability Analysis

The Wpify Woo plugin registers a REST API route through its ApiManager that maps to SettingsApi::save_option(). The handler reads two request parameters, option (the option name) and data (the value), and forwards them directly to the WordPress core function update_option(). No allowlist restricts which option names may be modified, and no sanitization is applied to the supplied value.

The route's permission_callback only verifies the manage_woocommerce capability. Shop Managers hold this capability by default in WooCommerce deployments. As a result, any authenticated user at the Shop Manager tier or above can invoke the endpoint and rewrite any option stored in the wp_options table.

An attacker can escalate to Administrator by combining option overwrites. Setting default_role to administrator and users_can_register to 1 allows self-registration with administrative privileges. Alternatively, modifying active_plugins removes security or firewall plugins, and rewriting siteurl or home redirects site traffic.

Root Cause

The root cause is missing option-name allowlisting and insufficient authorization. The plugin conflates the manage_woocommerce capability with authority to modify arbitrary WordPress core settings. Sensitive options that govern authentication and plugin activation should require the manage_options capability, which is reserved for Administrators.

Attack Vector

Exploitation requires an authenticated session with at least Shop Manager privileges. The attacker sends a crafted POST request to /wp-json/wpify-woo/v1/option supplying an arbitrary option name and value. The exploit code path and endpoint registration can be reviewed in the Wpify Woo SettingsApi source and the ApiManager registration. The complete technical breakdown is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-12736

Indicators of Compromise

POST requests to /wp-json/wpify-woo/v1/option originating from non-administrator sessions.
Unexpected changes to the default_role, users_can_register, active_plugins, siteurl, or home values in wp_options.
New user registrations with the Administrator role shortly after Shop Manager authentication events.
Security or firewall plugins disappearing from the active plugin list without corresponding admin activity.

Detection Strategies

Enable REST API request logging and alert on POSTs to the wpify-woo/v1/option route from users lacking the manage_options capability.
Audit wp_options changes using a database activity monitor or plugin such as WP Activity Log.
Correlate WordPress user role changes with recent REST API traffic to identify suspicious escalation sequences.

Monitoring Recommendations

Monitor the wp_users and wp_usermeta tables for new Administrator accounts created through self-registration.
Track modifications to critical options (default_role, active_plugins, users_can_register) with file integrity and configuration monitoring tooling.
Review web access logs for repeated 200 responses on the vulnerable REST route from the same authenticated session.

How to Mitigate CVE-2026-12736

Immediate Actions Required

Update the Wpify Woo plugin to a version later than 5.4.16 as soon as a fixed release is available from the vendor.
Audit Shop Manager and higher-privileged accounts, disable unused accounts, and rotate credentials.
Inspect wp_options for tampering, especially default_role, users_can_register, and active_plugins.
Remove any unauthorized Administrator accounts and re-enable disabled security plugins.

Patch Information

The vendor changeset addressing the vulnerable code is referenced in the WordPress plugin repository changeset. Site operators should apply the vendor-supplied update and verify that the save_option endpoint enforces an allowlist and stricter capability checks.

Workarounds

Restrict access to the /wp-json/wpify-woo/v1/option endpoint through a web application firewall (WAF) rule until the plugin is updated.
Deactivate the Wpify Woo plugin if it is not essential to production operations.
Reduce the number of accounts assigned the Shop Manager role and require multi-factor authentication for all privileged WordPress logins.
Apply a rest_pre_dispatch filter in a mu-plugin to block the vulnerable route for non-administrators.

bash

# Example WAF/nginx rule to block the vulnerable route
location ~ ^/wp-json/wpify-woo/v1/option {
    return 403;
}