CVE-2026-57377: WowAddons Authorization Bypass Vulnerability

CVE-2026-57377 Overview

CVE-2026-57377 is a Missing Authorization vulnerability [CWE-862] in the WPXPO WowAddons product-addons WordPress plugin. The flaw affects all versions up to and including 1.6.8. Attackers can exploit incorrectly configured access control security levels to perform actions that should require elevated privileges. The vulnerability is exploitable over the network without authentication or user interaction. Successful exploitation results in limited integrity and availability impact on affected WordPress sites.

Critical Impact
Unauthenticated attackers can invoke plugin functionality that lacks proper authorization checks, enabling modification of plugin-managed data on affected WordPress installations.

Affected Products

WPXPO WowAddons product-addons plugin versions through 1.6.8
WordPress sites with the WowAddons plugin installed and activated
Any hosting environment running vulnerable versions of the plugin

Discovery Timeline

2026-07-13 - CVE-2026-57377 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57377

Vulnerability Analysis

The vulnerability stems from Broken Access Control in the WPXPO WowAddons product-addons plugin. The plugin exposes functionality without verifying whether the requesting user holds the required capability or role. This class of flaw is tracked under [CWE-862: Missing Authorization]. Attackers can reach vulnerable endpoints remotely because the plugin registers actions accessible to unauthenticated users. The EPSS score is 0.242%, indicating a low but non-zero probability of exploitation activity in the near term.

Root Cause

The plugin fails to implement proper capability checks such as current_user_can() or nonce validation on privileged actions. When WordPress registers AJAX or REST endpoints without these checks, any client can invoke them. The plugin also does not enforce authenticated-only access via the wp_ajax_nopriv_ hook boundary. This results in access control decisions being made on client-supplied context rather than server-side authorization state.

Attack Vector

An attacker sends crafted HTTP requests directly to the plugin's exposed endpoints. No authentication token, session cookie, or user interaction is required. The attacker enumerates plugin actions and issues requests that trigger backend operations. Successful requests modify plugin-managed data or influence site behavior within the limits of the exposed functionality.

Refer to the Patchstack Vulnerability Report for endpoint-specific technical details.

Detection Methods for CVE-2026-57377

Indicators of Compromise

Unauthenticated HTTP POST requests to wp-admin/admin-ajax.php referencing WowAddons plugin actions
Unexpected modifications to WooCommerce product addon configurations or plugin option rows in wp_options
Requests to plugin-specific REST routes originating from external IP addresses without prior authentication
Elevated error rates or anomalous parameter patterns in web server access logs targeting product-addons paths

Detection Strategies

Inspect WordPress access logs for requests to plugin endpoints that lack a valid _wpnonce parameter or authenticated session cookie
Deploy Web Application Firewall (WAF) rules that flag POST requests to WowAddons AJAX actions from unauthenticated sources
Baseline normal administrative traffic against the plugin and alert on deviations originating from non-admin IP ranges

Monitoring Recommendations

Enable WordPress audit logging to capture changes to plugin settings and product addon definitions
Forward web server and PHP error logs to a centralized SIEM for correlation with authentication events
Monitor the WPXPO WowAddons plugin version across your WordPress fleet and alert on installations at or below 1.6.8

How to Mitigate CVE-2026-57377

Immediate Actions Required

Update the WPXPO WowAddons product-addons plugin to a version above 1.6.8 as soon as the vendor releases a patched release
Audit WordPress user accounts and plugin configurations for unauthorized modifications made through the vulnerable endpoints
Restrict administrative access to wp-admin and admin-ajax.php at the network or WAF layer where feasible

Patch Information

The vulnerability affects WowAddons versions through 1.6.8. Consult the Patchstack Vulnerability Report and the WPXPO vendor changelog for the fixed release version and upgrade guidance.

Workarounds

Deactivate the WowAddons plugin until a patched version is installed if the affected functionality is not business-critical
Deploy virtual patching via a WAF to block unauthenticated requests to WowAddons AJAX and REST endpoints
Enforce IP allowlisting on /wp-admin/ paths to limit reachability of plugin actions from untrusted networks

bash

# Example WAF rule concept to block unauthenticated access to plugin AJAX actions
# Adjust the action name(s) to match the vulnerable WowAddons endpoints identified in the advisory
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1057377,msg:'Block unauthenticated WowAddons action'"
  SecRule ARGS:action "@rx ^(wowaddons_|wpxpo_)" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"