Vulnerability · Published Jul 24, 2026 · Assigned by Wordfence

CVE-2026-12736WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint

High 8.0

In plain English

A high-severity privilege mismanagement in WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce from wpify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.6%top 53.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the manage_woocommerce capability. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by overwriting arbitrary WordPress options (for example setting default_role to administrator and users_can_register to 1, or disabling security plugins via active_plugins).

Affected products (as reported)

Vendor	Product	Versions
wpify	WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce	0 – through 5.4.16

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References