CVE-2026-3589

WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

High · published March 6, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
8.1
In the wild
Unconfirmed
What it is

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00190 · 8.1th percentile
Published
2026-03-06T09:11Z
EPSS history
Timeline
  • 06 MAR 09:11Z
    WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF
    cvelistv5