Security Alert Summary
The Empik for Woocommerce plugin contains an authorization bypass vulnerability that allows authenticated users with subscriber-level access and above to modify WooCommerce product metadata. The issue affects versions up to and including 1.5.1 and arises from the plugin not properly verifying that a user is authorized to perform certain actions.
CVE Details
- CVE ID: CVE-2026-9766
- Affected component: Empik for Woocommerce (WordPress plugin)
- Affected versions: All versions up to and including 1.5.1
- Published: September 19, 2026 at 9:16:35 AM
- Last modified: September 19, 2026 at 2:17:06 PM
- CVSS v3.1 base score: 4.3
- CVSS v3.1 severity: MEDIUM
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction:
- Authentication: Required (authenticated attackers)
- Privileges Required: LOW (the report notes subscribers and above can exploit)
- User Interaction: NONE
- Primary impact:
- Confidentiality: NONE
- Integrity: LOW (ability to modify product metadata)
- Availability: NONE
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
According to the advisory, the plugin does not properly verify that a user is authorized to perform certain actions. This authorization bypass makes it possible for authenticated users with low-level privileges (subscriber and above) to modify arbitrary WooCommerce product metadata.
The vulnerability is linked to admin-side code paths in the plugin. The report references plugin files including src/Wp_Admin/CSV/CSV_Ajax.php, src/Wp_Admin/CSV/CSV_Import.php, src/Wp_Admin/Products_List_Offers_import_Column.php, and src/Wp_Admin/Products_List_Product_import_Column.php. These files are used by the plugin’s admin import and CSV handling functionality and are the locations cited in the advisory.
Exploitability is supported by the CVSS vector: the issue is network-accessible and requires only low privileges and no user interaction. The impact is limited to integrity of product metadata rather than disclosure of sensitive data or denial of service. Specifically, attackers can modify metadata keys such as _empik_logistic_klass, _empik_product_state, _empik_product_state_all_variants, and Empik export and offer flags for products in the store.
How This Could Impact Your Website
Consider a typical small business WordPress site with an owner, internal staff (shop managers or editors), and external contractors or contributors who have low-level accounts. If a subscriber-level account or other low-privilege account is compromised or abused, an attacker could alter product metadata. Practical consequences include incorrect shipping or logistic classifications being applied to products, product state changes that affect listings, or export flags being modified so products are included or excluded from external feeds.
These changes can lead to operational disruption, customer confusion, and increased risk of targeted social engineering. For example, inaccurate product listings could be used by attackers to craft convincing phishing messages to staff or partners, or to manipulate inventory-related workflows.
professional review If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor or subscriber accounts that do not need access to admin features.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and product metadata changes for unusual behavior or unexpected modifications.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/CSV/CSV_Ajax.php#L12
- https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/CSV/CSV_Ajax.php#L19
- https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/CSV/CSV_Ajax.php#L64
- https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/CSV/CSV_Import.php#L38
- https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/Products_List_Offers_import_Column.php#L29
- https://plugins.trac.wordpress.org/browser/empik-for-woocommerce/tags/1.5.1/src/Wp_Admin/Products_List_Product_import_Column.php#L28
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3592900%40empik-for-woocommerce&new=3592900%40empik-for-woocommerce
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a0a5259d-7340-48b5-a0cf-f68abdb21156?source=cve
