CVE-2026-3589 - WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

Back Back to CVE browser

HIGH

WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

Published Mar 6, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.19%

Description

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.

Affected products

Vendor Automattic Product WooCommerce Default
unaffected
- Version
  10.0.0
  Status
  affected
  Constraints
  <10.0.6
- Version
  10.1.0
  Status
  affected
  Constraints
  <10.1.4
- Version
  10.2.0
  Status
  affected
  Constraints
  <10.2.4
- Version
  10.3.0
  Status
  affected
  Constraints
  <10.3.8
- Version
  10.4.0
  Status
  affected
  Constraints
  <10.4.4
- Version
  10.5.0
  Status
  affected
  Constraints
  <10.5.3
- Version
  5.4.0
  Status
  affected
  Constraints
  <5.4.4
- Version
  5.5.0
  Status
  affected
  Constraints
  <5.4.5
- Version
  5.6.0
  Status
  affected
  Constraints
  <5.6.3
- Version
  5.7.0
  Status
  affected
  Constraints
  <5.7.3
- Version
  5.8.0
  Status
  affected
  Constraints
  <5.8.2
- Version
  5.9.0
  Status
  affected
  Constraints
  <5.9.2
- Version
  6.0.0
  Status
  affected
  Constraints
  <6.0.2
- Version
  6.1.0
  Status
  affected
  Constraints
  <6.1.3
- Version
  6.2.0
  Status
  affected
  Constraints
  <6.2.3
- Version
  6.3.0
  Status
  affected
  Constraints
  <6.3.2
- Version
  6.4.0
  Status
  affected
  Constraints
  <6.4.2
- Version
  6.5.0
  Status
  affected
  Constraints
  <6.5.2
- Version
  6.6.0
  Status
  affected
  Constraints
  <6.6.2
- Version
  6.7.0
  Status
  affected
  Constraints
  <6.7.1
- Version
  6.8.0
  Status
  affected
  Constraints
  <6.8.3
- Version
  6.9.0
  Status
  affected
  Constraints
  <6.9.5
- Version
  7.0.0
  Status
  affected
  Constraints
  <7.0.2
- Version
  7.1.0
  Status
  affected
  Constraints
  <7.1.2
- Version
  7.2.0
  Status
  affected
  Constraints
  <7.2.4
- Version
  7.3.0
  Status
  affected
  Constraints
  <7.3.1
- Version
  7.4.0
  Status
  affected
  Constraints
  <7.4.2
- Version
  7.5.0
  Status
  affected
  Constraints
  <7.5.2
- Version
  7.6.0
  Status
  affected
  Constraints
  <7.6.2
- Version
  7.7.0
  Status
  affected
  Constraints
  <7.7.3
- Version
  7.8.0
  Status
  affected
  Constraints
  <7.8.4
- Version
  7.9.0
  Status
  affected
  Constraints
  <7.9.2
- Version
  8.0.0
  Status
  affected
  Constraints
  <8.0.5
- Version
  8.1.0
  Status
  affected
  Constraints
  <8.1.4
- Version
  8.2.0
  Status
  affected
  Constraints
  <8.2.5
- Version
  8.3.0
  Status
  affected
  Constraints
  <8.3.4
- Version
  8.4.0
  Status
  affected
  Constraints
  <8.4.3
- Version
  8.5.0
  Status
  affected
  Constraints
  <8.5.5
- Version
  8.6.0
  Status
  affected
  Constraints
  <8.6.4
- Version
  8.7.0
  Status
  affected
  Constraints
  <8.7.3
- Version
  8.8.0
  Status
  affected
  Constraints
  <8.8.7
- Version
  8.9.0
  Status
  affected
  Constraints
  <8.9.5
- Version
  9.0.0
  Status
  affected
  Constraints
  <9.0.4
- Version
  9.1.0
  Status
  affected
  Constraints
  <9.1.7
- Version
  9.2.0
  Status
  affected
  Constraints
  <9.2.5
- Version
  9.3.0
  Status
  affected
  Constraints
  <9.3.6
- Version
  9.4.0
  Status
  affected
  Constraints
  <9.4.5
- Version
  9.5.0
  Status
  affected
  Constraints
  <9.5.4
- Version
  9.6.0
  Status
  affected
  Constraints
  <9.6.4
- Version
  9.7.0
  Status
  affected
  Constraints
  <9.7.3
- Version
  9.8.0
  Status
  affected
  Constraints
  <9.8.7
- Version
  9.9.0
  Status
  affected
  Constraints
  <9.9.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Automattic

WooCommerce

unaffected

Version	Status	Constraints
10.0.0	affected	<10.0.6
10.1.0	affected	<10.1.4
10.2.0	affected	<10.2.4
10.3.0	affected	<10.3.8
10.4.0	affected	<10.4.4
10.5.0	affected	<10.5.3
5.4.0	affected	<5.4.4
5.5.0	affected	<5.4.5
5.6.0	affected	<5.6.3
5.7.0	affected	<5.7.3
5.8.0	affected	<5.8.2
5.9.0	affected	<5.9.2
6.0.0	affected	<6.0.2
6.1.0	affected	<6.1.3
6.2.0	affected	<6.2.3
6.3.0	affected	<6.3.2
6.4.0	affected	<6.4.2
6.5.0	affected	<6.5.2
6.6.0	affected	<6.6.2
6.7.0	affected	<6.7.1
6.8.0	affected	<6.8.3
6.9.0	affected	<6.9.5
7.0.0	affected	<7.0.2
7.1.0	affected	<7.1.2
7.2.0	affected	<7.2.4
7.3.0	affected	<7.3.1
7.4.0	affected	<7.4.2
7.5.0	affected	<7.5.2
7.6.0	affected	<7.6.2
7.7.0	affected	<7.7.3
7.8.0	affected	<7.8.4
7.9.0	affected	<7.9.2
8.0.0	affected	<8.0.5
8.1.0	affected	<8.1.4
8.2.0	affected	<8.2.5
8.3.0	affected	<8.3.4
8.4.0	affected	<8.4.3
8.5.0	affected	<8.5.5
8.6.0	affected	<8.6.4
8.7.0	affected	<8.7.3
8.8.0	affected	<8.8.7
8.9.0	affected	<8.9.5
9.0.0	affected	<9.0.4
9.1.0	affected	<9.1.7
9.2.0	affected	<9.2.5
9.3.0	affected	<9.3.6
9.4.0	affected	<9.4.5
9.5.0	affected	<9.5.4
9.6.0	affected	<9.6.4
9.7.0	affected	<9.7.3
9.8.0	affected	<9.8.7
9.9.0	affected	<9.9.7

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (2)

https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/
technical-description
https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/		technical-description
https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Mar 6, 2026

Updated Mar 6, 2026

Reserved Mar 5, 2026

Link CVE-2026-3589

CISA Vulnrichment

Updated Mar 6, 2026

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2026-3589

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-3589