CVE-2026-49072: WooCommerce Anti-Fraud Auth Bypass Flaw

CVE-2026-49072 Overview

CVE-2026-49072 is an unauthenticated broken access control vulnerability in the WooCommerce Anti-Fraud plugin for WordPress, affecting versions up to and including 7.2.6. The flaw is classified under [CWE-862: Missing Authorization]. Remote attackers can reach affected plugin functionality over the network without authentication or user interaction. Successful exploitation can lead to limited integrity and availability impact on the WordPress store environment using the plugin.

Critical Impact
Unauthenticated attackers can interact with protected plugin functionality due to missing authorization checks, allowing tampering with anti-fraud logic on WooCommerce stores running version 7.2.6 or earlier.

Affected Products

WooCommerce Anti-Fraud plugin for WordPress
All versions up to and including 7.2.6
WordPress sites running WooCommerce with this plugin enabled

Discovery Timeline

2026-06-17 - CVE-2026-49072 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49072

Vulnerability Analysis

The vulnerability stems from missing authorization controls in the WooCommerce Anti-Fraud plugin. The plugin exposes functionality that should be restricted to privileged users but fails to verify the caller's identity or capabilities. Unauthenticated network attackers can reach these endpoints directly. The flaw maps to [CWE-862: Missing Authorization], a recurring weakness in WordPress plugin ecosystems where capability checks (current_user_can()) and nonce verification (check_admin_referer()) are omitted from sensitive handlers.

The EPSS score is 0.318% with a percentile of 23.376, suggesting limited active exploitation prediction at publication time. The attack requires no user interaction and no privileges, lowering the barrier for opportunistic exploitation against exposed WordPress storefronts.

Root Cause

The root cause is the absence of authorization and capability validation on plugin handlers in WooCommerce Anti-Fraud through version 7.2.6. Handlers accessible via standard WordPress request entry points (such as admin-ajax.php or REST routes) do not enforce that the caller holds the required role or capability before executing privileged actions.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends crafted HTTP requests directly to the vulnerable plugin endpoints on a target WordPress site running the affected version. Because no authentication is required and no user interaction is needed, exploitation can be fully automated and scaled across exposed sites. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-49072

Indicators of Compromise

Unexpected requests to WooCommerce Anti-Fraud plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ from unauthenticated sources.
Modifications to anti-fraud configuration, scoring rules, or order risk states without a corresponding administrator session.
Orders bypassing fraud scoring or being approved despite matching previously blocked patterns.

Detection Strategies

Inspect WordPress access logs for requests targeting WooCommerce Anti-Fraud actions originating without valid session cookies or nonces.
Correlate plugin configuration changes in the WordPress database (wp_options) with authenticated administrator activity.
Deploy a web application firewall rule that requires authentication context for plugin-specific AJAX actions and REST routes.

Monitoring Recommendations

Monitor outbound order approval rates and fraud-score distributions for anomalous shifts after deployment of the plugin.
Alert on bursts of requests to plugin endpoints from single IP addresses or non-browser user agents.
Track plugin file integrity and option changes using a WordPress security monitoring tool.

How to Mitigate CVE-2026-49072

Immediate Actions Required

Identify all WordPress sites running the WooCommerce Anti-Fraud plugin and confirm the installed version.
Update the plugin to a version above 7.2.6 once the vendor publishes a fixed release.
Restrict access to /wp-admin/admin-ajax.php and plugin REST routes at the WAF or reverse proxy layer where feasible.

Patch Information

Review the Patchstack Vulnerability Report for the latest fixed version information and vendor remediation guidance. Apply the patched plugin version as soon as it is available through the WordPress plugin repository.

Workarounds

Temporarily deactivate the WooCommerce Anti-Fraud plugin until a patched version is installed if exposure is a concern.
Apply WAF rules that block unauthenticated requests to the plugin's AJAX actions and REST endpoints.
Audit recent order approvals and anti-fraud configuration changes for signs of tampering, and revert unauthorized modifications.

bash

# Example WP-CLI commands to identify and remediate affected installs
wp plugin list --name=woocommerce-anti-fraud --field=version
wp plugin update woocommerce-anti-fraud
wp plugin deactivate woocommerce-anti-fraud   # if no patch is yet available