Security Alert Summary
The Custom Thank You Page for WooCommerce plugin for WordPress contains a missing capability check in the save_option() function in all versions up to and including 1.1.2. This omission can allow unauthenticated actors to export or reset (delete) the plugin’s settings without proper permission checks.
CVE Details
- CVE ID: CVE-2026-4806
- Affected component: Custom Thank You Page for WooCommerce plugin for WordPress
- Affected versions: All versions up to and including 1.1.2
- Published: September 24, 2026 at 12:17:12 PM
- Last modified: September 24, 2026 at 4:17:07 PM
- CVSS v3.1: Base Score 6.5, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Authentication / privileges / user interaction: No authentication required (Privileges Required: NONE), User Interaction: NONE. Attack Vector: NETWORK, Attack Complexity: LOW, Scope: UNCHANGED.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The plugin contains a missing capability check on the save_option() function. Because the function lacks proper authorization verification, requests that invoke this code path can perform configuration export or reset operations without validating the caller’s privileges.
The core issue exists in all versions up to and including 1.1.2 as reported. The vulnerability allows unauthenticated requests to trigger export or deletion of the plugin’s settings. The description identifies save_option() by name as the function missing the capability check.
Impact is limited to the plugin’s settings: attackers can obtain or remove configuration data for the Custom Thank You Page for WooCommerce plugin. The available CVSS data indicates confidentiality and integrity impacts are low and there is no availability impact.
How This Could Impact Your Website
In a typical scenario, a site owner has several internal staff accounts and may also work with external contractors or contributors. If an unauthenticated actor exports plugin settings, those settings might contain values that reveal configuration details or contact information used by the team. If settings are reset or deleted, internal staff who rely on those configurations could experience broken thank-you pages or missing tracking and messaging behavior until settings are restored.
Practical consequences include potential exposure of configuration-related information or emails contained in settings and an increased risk of targeted phishing or social engineering against staff whose details appear in exported configurations. While the CVSS impacts are limited, these outcomes can create operational disruption and privacy concerns for staff and contractors.
professional review: If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privilege accounts.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior related to plugin settings exports or resets.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
