CVE-2026-91009 Overview
The Active Woot Products Tables for WooCommerce WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability in versions prior to 2.1.3. The plugin fails to enforce authorization and CSRF checks on several AJAX actions. Any authenticated user, including low-privileged subscriber accounts, can modify the title of arbitrary posts, pages, and WooCommerce products. This weakness is tracked as [CWE-352] and impacts content integrity across the WordPress site.
Critical Impact
Authenticated subscribers can rewrite titles of any post, page, or WooCommerce product, enabling content defacement and store manipulation.
Affected Products
- Active Woot Products Tables for WooCommerce plugin (versions before 2.1.3)
- WordPress sites running the vulnerable plugin
- WooCommerce stores exposing subscriber registration
Discovery Timeline
- 2026-09-17 - CVE-2026-91009 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91009
Vulnerability Analysis
The plugin registers AJAX endpoints that perform state-changing operations without verifying the origin of the request or the capabilities of the caller. WordPress plugins are expected to gate privileged AJAX handlers with check_ajax_referer() nonce verification and current_user_can() capability checks. The Active Woot plugin omits both controls on the affected handlers.
As a result, any user session with the subscriber role can invoke the title-update action against arbitrary post IDs. The action also executes when a logged-in administrator visits an attacker-controlled page that triggers the request, since no nonce blocks cross-origin form submissions. The impact is limited to integrity of post titles, but that scope covers pages, blog posts, and WooCommerce products across the site.
Root Cause
The root cause is missing authorization enforcement and missing CSRF token validation on privileged AJAX actions. The handlers trust the authenticated session without confirming that the user holds an editing capability or that the request originated from the WordPress admin interface.
Attack Vector
An attacker with a valid subscriber account sends a crafted admin-ajax.php POST request containing the target post ID and replacement title. Alternatively, the attacker hosts a page that auto-submits a form to admin-ajax.php, and any authenticated user who visits that page triggers the title change. Refer to the WPScan Vulnerability Details for the disclosed technical breakdown.
Detection Methods for CVE-2026-91009
Indicators of Compromise
- Unexpected changes to post, page, or product titles in the WordPress database wp_posts.post_title column
- POST requests to /wp-admin/admin-ajax.php originating from low-privilege user sessions or external referrers
- Audit-log entries showing title edits performed by users lacking edit_posts capability
Detection Strategies
- Review web server access logs for admin-ajax.php POST activity tied to subscriber-role accounts
- Deploy a WordPress activity plugin that logs post-title modifications with the acting user ID and source IP
- Compare current post titles against known-good backups to identify unauthorized modifications
Monitoring Recommendations
- Alert on spikes in AJAX requests to the vulnerable plugin action names
- Monitor new subscriber registrations followed by immediate AJAX activity
- Track referrer headers on admin-ajax traffic and flag requests originating outside the site domain
How to Mitigate CVE-2026-91009
Immediate Actions Required
- Upgrade the Active Woot Products Tables for WooCommerce plugin to version 2.1.3 or later
- Audit user roles and remove unused subscriber accounts
- Review recent post, page, and product titles for unauthorized modifications and restore from backup as needed
Patch Information
The vendor addressed the issue in version 2.1.3 by adding capability and nonce checks to the affected AJAX handlers. Site administrators should update through the WordPress plugin dashboard or replace the plugin files with the patched release. See the WPScan Vulnerability Details for advisory information.
Workarounds
- Disable the Active Woot Products Tables for WooCommerce plugin until the patched version is installed
- Restrict new user registrations or disable the subscriber role on sites that do not require it
- Deploy a web application firewall rule that blocks unauthenticated or low-privileged access to the affected admin-ajax.php actions
# Configuration example
# Update the plugin via WP-CLI
wp plugin update active-woot-products-tables-for-woocommerce --version=2.1.3
# Optionally disable open registration until patched
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
