CVE-2026-27046: StoreCustomizer Auth Bypass Vulnerability

CVE-2026-27046 Overview

CVE-2026-27046 is a Missing Authorization vulnerability (CWE-862) affecting the Kaira StoreCustomizer WordPress plugin (woocustomizer). This broken access control flaw allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized modifications to WooCommerce store customizations. The vulnerability impacts all versions of StoreCustomizer through version 2.6.3.

Critical Impact

Authenticated attackers with low-level privileges can bypass authorization checks to modify store customization settings, potentially altering storefront appearance, product displays, or checkout configurations without proper authorization.

Affected Products

• Kaira StoreCustomizer WordPress Plugin versions up to and including 2.6.3
• WordPress installations running the vulnerable woocustomizer plugin
• WooCommerce stores utilizing StoreCustomizer for storefront customization

Discovery Timeline

• 2026-03-25 - CVE-2026-27046 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-27046

Vulnerability Analysis

This vulnerability stems from missing authorization checks within the StoreCustomizer plugin. The plugin fails to properly verify user permissions before allowing access to certain administrative functions related to WooCommerce store customization. As a result, authenticated users with minimal privileges (such as subscribers or customers) can access and modify settings that should be restricted to administrators only.

The attack requires network access and low-privilege authentication, making it exploitable by any registered user on a vulnerable WordPress site. The primary impact is to data integrity, as unauthorized users can modify store customization settings without proper authorization.

Root Cause

The root cause of CVE-2026-27046 is the absence of proper capability checks in the StoreCustomizer plugin's AJAX handlers and REST API endpoints. WordPress plugins should implement current_user_can() checks to verify that the authenticated user possesses the appropriate capabilities (such as manage_woocommerce or edit_theme_options) before processing requests that modify store settings.

Without these authorization checks, the plugin trusts that any authenticated request is legitimate, creating a broken access control vulnerability that allows privilege escalation for low-privilege users.

Attack Vector

The attack vector for this vulnerability is network-based and requires low-privilege authentication. An attacker would:

1. Register or obtain access to a low-privilege account on the target WordPress site (e.g., subscriber or customer role)
2. Identify the vulnerable StoreCustomizer plugin endpoints that lack authorization checks
3. Send crafted requests to these endpoints to modify store customization settings
4. Potentially alter product displays, checkout flows, or storefront appearance without administrator approval

The vulnerability does not require user interaction and can be exploited directly against the WordPress REST API or AJAX endpoints exposed by the plugin. Technical details regarding specific vulnerable endpoints can be found in the Patchstack vulnerability database entry.

Detection Methods for CVE-2026-27046

Indicators of Compromise

• Unexpected changes to WooCommerce storefront customization settings without administrator action
• WordPress audit logs showing store customization modifications by non-administrator users
• Unusual AJAX or REST API requests to StoreCustomizer plugin endpoints from low-privilege accounts
• Modified storefront layouts, product displays, or checkout configurations that were not authorized

Detection Strategies

• Monitor WordPress activity logs for customization changes made by users without administrative roles
• Implement Web Application Firewall (WAF) rules to detect and alert on unauthorized plugin endpoint access
• Review user activity patterns for subscribers or customers accessing administrative plugin functions
• Deploy endpoint detection to identify anomalous API requests targeting the woocustomizer plugin

Monitoring Recommendations

• Enable comprehensive WordPress audit logging using plugins like WP Activity Log or Sucuri
• Configure alerts for any store customization changes to notify administrators immediately
• Monitor HTTP traffic for requests to StoreCustomizer AJAX handlers from non-admin user sessions
• Regularly review user roles and capabilities to ensure proper access control configuration

How to Mitigate CVE-2026-27046

Immediate Actions Required

• Update the StoreCustomizer (woocustomizer) plugin to the latest patched version immediately
• Review recent store customization changes for unauthorized modifications and revert if necessary
• Audit user accounts to identify any suspicious activity from low-privilege users
• Consider temporarily deactivating the plugin if an update is not yet available

Patch Information

Organizations should check the Patchstack vulnerability database for the latest patch information and update guidance. Upgrading to a version newer than 2.6.3 that includes proper authorization checks is the recommended remediation.

Workarounds

• Implement a Web Application Firewall (WAF) with rules to restrict access to StoreCustomizer endpoints based on user roles
• Temporarily restrict user registration on the WordPress site to reduce the attack surface
• Use WordPress security plugins to add additional capability checks at the application level
• Monitor and log all plugin-related API requests for forensic analysis until patching is complete

# WordPress CLI command to check StoreCustomizer plugin version
wp plugin list --name=woocustomizer --format=table

# Update the plugin to the latest version
wp plugin update woocustomizer

# Verify the update was successful
wp plugin get woocustomizer --field=version