CVE-2026-3589

WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

State: Published
Severity: 7.5 High
Published: Mar 6, 2026
Updated: Mar 6, 2026
Reserved: Mar 5, 2026

Description

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
WooCommerceAutomattic	5.4.0 to before 5.4.4Affected 5.5.0 to before 5.4.5Affected 5.6.0 to before 5.6.3Affected 5.7.0 to before 5.7.3Affected 5.8.0 to before 5.8.2Affected 5.9.0 to before 5.9.2Affected 6.0.0 to before 6.0.2Affected 6.1.0 to before 6.1.3Affected 6.2.0 to before 6.2.3Affected 6.3.0 to before 6.3.2Affected 6.4.0 to before 6.4.2Affected 6.5.0 to before 6.5.2Affected 6.6.0 to before 6.6.2Affected 6.7.0 to before 6.7.1Affected 6.8.0 to before 6.8.3Affected 6.9.0 to before 6.9.5Affected 7.0.0 to before 7.0.2Affected 7.1.0 to before 7.1.2Affected 7.2.0 to before 7.2.4Affected 7.3.0 to before 7.3.1Affected 7.4.0 to before 7.4.2Affected 7.5.0 to before 7.5.2Affected 7.6.0 to before 7.6.2Affected 7.7.0 to before 7.7.3Affected 7.8.0 to before 7.8.4Affected and 27 more versions

Product

Versions

WooCommerceAutomattic

5.4.0 to before 5.4.4Affected
5.5.0 to before 5.4.5Affected
5.6.0 to before 5.6.3Affected
5.7.0 to before 5.7.3Affected
5.8.0 to before 5.8.2Affected
5.9.0 to before 5.9.2Affected
6.0.0 to before 6.0.2Affected
6.1.0 to before 6.1.3Affected
6.2.0 to before 6.2.3Affected
6.3.0 to before 6.3.2Affected
6.4.0 to before 6.4.2Affected
6.5.0 to before 6.5.2Affected
6.6.0 to before 6.6.2Affected
6.7.0 to before 6.7.1Affected
6.8.0 to before 6.8.3Affected
6.9.0 to before 6.9.5Affected
7.0.0 to before 7.0.2Affected
7.1.0 to before 7.1.2Affected
7.2.0 to before 7.2.4Affected
7.3.0 to before 7.3.1Affected
7.4.0 to before 7.4.2Affected
7.5.0 to before 7.5.2Affected
7.6.0 to before 7.6.2Affected
7.7.0 to before 7.7.3Affected
7.8.0 to before 7.8.4Affected
and 27 more versions

References

https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/exploitvdb-entrytechnical-description
https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/technical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.