Vulnerability · Published Oct 30, 2026 · Assigned by WPScan

CVE-2026-118072Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting

Medium 5.4

In plain English

A medium-severity missing authorization in Fraud Prevention For WooCommerce and EDD from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 93.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Fraud Prevention For WooCommerce and EDD	0 – before 2.3.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://wpscan.com/vulnerability/3bb95ff2-b7b6-438f-9a92-9533975579af/ exploit, vdb-entry, technical-description