CVE-2026-9766: Empik for WooCommerce Auth Bypass Vulnerability

CVE-2026-9766 Overview

CVE-2026-9766 is an authorization bypass vulnerability in the Empik for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 1.5.1. The plugin fails to verify that a user is authorized to perform sensitive actions before executing them. Authenticated attackers with subscriber-level access or higher can modify arbitrary WooCommerce product metadata across the store. Affected metadata includes _empik_logistic_klass, _empik_product_state, _empik_product_state_all_variants, and Empik export and offer flags. The vulnerability is categorized under CWE-862: Missing Authorization.

Critical Impact
Any authenticated WordPress subscriber can tamper with WooCommerce product metadata, disrupting Empik logistics classifications, product state, and export flags across every product in the catalog.

Affected Products

Empik for WooCommerce plugin for WordPress, versions ≤ 1.5.1
WordPress sites running the plugin with subscriber-or-higher user registration enabled
WooCommerce stores relying on Empik integration for logistics and offer management

Discovery Timeline

2026-09-19 - CVE-2026-9766 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-9766

Vulnerability Analysis

The vulnerability resides in the plugin's admin-side handlers that process CSV imports and product metadata updates. The affected files include src/Wp_Admin/CSV/CSV_Ajax.php, src/Wp_Admin/CSV/CSV_Import.php, src/Wp_Admin/Products_List_Offers_import_Column.php, and src/Wp_Admin/Products_List_Product_import_Column.php. These handlers execute privileged product-metadata write operations without validating whether the requesting user holds the required WooCommerce or WordPress capabilities. As a result, an attacker with a low-privilege account can invoke the handlers to alter Empik-specific product fields on any product in the store.

Root Cause

The root cause is missing authorization enforcement in AJAX and admin action handlers. The code paths register callbacks that update post meta keys such as _empik_logistic_klass, _empik_product_state, and _empik_product_state_all_variants, but do not call current_user_can() with an appropriate capability such as edit_products or manage_woocommerce. Nonce checks alone, where present, do not substitute for capability checks and do not restrict which authenticated role may act.

Attack Vector

Exploitation is network-based and requires an authenticated session at subscriber level or above. The attacker sends crafted requests to the plugin's vulnerable AJAX endpoints, supplying arbitrary product IDs and values for the Empik metadata fields. Because there is no server-side capability check, the plugin accepts the request and writes the attacker-controlled values to the targeted products' metadata, affecting logistics classification, product state, and Empik offer/export behavior across the storefront.

No public proof-of-concept code has been released. Technical details are available in the Wordfence advisory for CVE-2026-9766 and the WordPress plugin source browser.

Detection Methods for CVE-2026-9766

Indicators of Compromise

Unexpected changes to WooCommerce product meta keys _empik_logistic_klass, _empik_product_state, _empik_product_state_all_variants, or Empik export/offer flags across many products.
WordPress access logs showing subscriber-role accounts issuing POST requests to admin-ajax.php with Empik plugin action names.
Bulk product metadata modifications outside normal administrator activity windows.

Detection Strategies

Audit the wp_postmeta table for Empik-related meta keys and flag mass updates that do not correspond to administrator sessions.
Correlate admin-ajax.php requests with the authenticated user role, alerting on non-admin roles invoking plugin admin actions.
Monitor for CSV import invocations originating from non-administrator accounts.

Monitoring Recommendations

Enable WordPress activity logging for user meta changes, plugin AJAX calls, and product edits.
Forward web server and application logs to a centralized platform such as Singularity Data Lake for retention and analytic queries against WordPress admin actions.
Alert on new or dormant subscriber accounts issuing requests to /wp-admin/admin-ajax.php with Empik action parameters.

How to Mitigate CVE-2026-9766

Immediate Actions Required

Update the Empik for WooCommerce plugin to a version later than 1.5.1 that includes the fix from changeset 3592900.
Audit existing product metadata for tampering with Empik logistic class, product state, and offer/export flags, and restore known-good values from backup where discrepancies exist.
Review the WordPress user list and remove or downgrade untrusted subscriber accounts.

Patch Information

The vendor addressed the missing authorization by adding capability enforcement in the affected admin handlers. The fix is tracked in WordPress plugin changeset 3592900. Site operators should upgrade to the first plugin release that incorporates this changeset.

Workarounds

Disable open user registration or restrict registration to trusted roles until the plugin is upgraded.
Deactivate the Empik for WooCommerce plugin on sites that do not require it pending patch deployment.
Apply a web application firewall rule that blocks non-administrator sessions from invoking Empik plugin AJAX actions.

bash

# Disable open registration and lower default new-user role via wp-cli
wp option update users_can_register 0
wp option update default_role subscriber

# Deactivate the vulnerable plugin until patched
wp plugin deactivate empik-for-woocommerce

# After patch is available, update to the fixed release
wp plugin update empik-for-woocommerce