Platform
wordpress
Component
woocommerce
Fixed in
5.4.4
5.4.5
5.6.3
5.7.3
5.8.2
5.9.2
6.0.2
6.1.3
6.2.3
6.3.2
6.4.2
6.5.2
6.6.2
6.7.1
6.8.3
6.9.5
7.0.2
7.1.2
7.2.4
7.3.1
7.4.2
7.5.2
7.6.2
7.7.3
7.8.4
7.9.2
8.0.5
8.1.4
8.2.5
8.3.4
8.4.3
8.5.5
8.6.4
8.7.3
8.8.7
8.9.5
9.0.4
9.1.7
9.2.5
9.3.6
9.4.5
9.5.4
9.6.4
9.7.3
9.8.7
9.9.7
10.0.6
10.1.4
10.2.4
10.3.8
10.4.4
10.5.3
10.5.3
CVE-2026-3589 is a Cross-Site Request Forgery (XSRF) vulnerability affecting the WooCommerce plugin for WordPress. This flaw allows unauthenticated attackers to potentially execute unauthorized actions on a WordPress site if they can manipulate a site administrator into performing those actions. The vulnerability impacts all WooCommerce versions prior to 10.5.3 (exclusive). A patch is available in version 10.5.3.
The core impact of CVE-2026-3589 lies in its ability to facilitate unauthorized actions within a WooCommerce-powered WordPress site. An attacker could craft malicious links or embed them in seemingly harmless content, such as emails or social media posts. If a site administrator clicks on such a link while logged into their WordPress account, the attacker can trigger actions as if they were the administrator. This could include modifying product details, processing fraudulent orders, or even altering site configurations. The blast radius is significant, potentially impacting the entire e-commerce operation and compromising sensitive customer data. The risk is amplified if the administrator has broad permissions within the WooCommerce system. This vulnerability shares similarities with other XSRF attacks, where user interaction is exploited to gain unauthorized access.
CVE-2026-3589 was published on March 10, 2026. Its CVSS score of 4.3 (MEDIUM) indicates a moderate level of severity. As of the publication date, there are no publicly known Proof-of-Concept (POC) exploits. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog or has an EPSS score. Active exploitation campaigns are not currently reported, but the XSRF nature of the vulnerability means it remains a potential threat, especially given the widespread use of WooCommerce.
Exploit Status
EPSS
0.03% (10% percentile)
CVSS Vector
The primary mitigation for CVE-2026-3589 is to immediately upgrade the WooCommerce plugin to version 10.5.3 or later. Prior to upgrading, it's advisable to create a full backup of your WordPress site, including the database and plugin files, to facilitate a rollback if the upgrade introduces unforeseen compatibility issues. While awaiting the upgrade, consider implementing temporary protections such as a Web Application Firewall (WAF) configured to filter out suspicious requests containing potentially malicious parameters. Specifically, look for requests with unusual or unexpected URLs targeting WooCommerce endpoints. Additionally, educate administrators about the risks of clicking on unknown links and verify the legitimacy of any requests before confirming them. After upgrading to 10.5.3, confirm the fix by attempting to trigger a WooCommerce action (e.g., creating a test product) through a crafted URL; the action should be rejected due to proper nonce validation.
Update to version 10.5.3, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
It's a Cross-Site Request Forgery (XSRF) vulnerability in the WooCommerce plugin for WordPress, allowing attackers to perform unauthorized actions if they can trick an administrator.
If you're using WooCommerce version 10.5.3 or earlier, you are potentially affected by this vulnerability. Immediate action is required.
Upgrade your WooCommerce plugin to version 10.5.3 or later. Back up your site before upgrading to allow for rollback if needed.
As of the publication date, there are no publicly known active exploitation campaigns, but the vulnerability remains a potential threat.
Refer to the official WooCommerce security advisory and the NVD entry for CVE-2026-3589 for detailed information and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.