Vulnerability · Published Oct 9, 2026 · Assigned by WPScan

CVE-2026-86850SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion

Medium 6.5

In plain English

A medium-severity missing authorization in SKU Error Fixer for WooCommerce from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 94.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind.

Affected products (as reported)

Vendor	Product	Versions
Unknown	SKU Error Fixer for WooCommerce	0 – through 1.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

References

https://wpscan.com/vulnerability/889aaa2a-ad05-423a-a601-70ac1d8b7920/ exploit, vdb-entry, technical-description