{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/wpify-woo-plugin--5.4.16/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8,"id":"CVE-2026-12736"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Wpify Woo plugin (\u003c= 5.4.16)","WordPress"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","wordpress","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Wpify","WordPress"],"content_html":"\u003cp\u003eA critical privilege escalation vulnerability, tracked as CVE-2026-12736, has been identified in the Wpify Woo plugin for WordPress, impacting all versions up to and including 5.4.16. This flaw stems from improper validation within the \u003ccode\u003eSettingsApi::save_option()\u003c/code\u003e REST route, accessible via \u003ccode\u003ePOST /wp-json/wpify-woo/v1/option\u003c/code\u003e. The vulnerable route directly passes user-supplied 'option' and 'data' parameters to WordPress's \u003ccode\u003eupdate_option()\u003c/code\u003e function without adequate allowlisting or sanitization. This oversight enables authenticated attackers, requiring only 'Shop Manager' level access or higher, to manipulate sensitive WordPress options. Exploitation can lead to the elevation of privileges to Administrator, for instance, by altering the \u003ccode\u003edefault_role\u003c/code\u003e to \u003ccode\u003eadministrator\u003c/code\u003e and \u003ccode\u003eusers_can_register\u003c/code\u003e to \u003ccode\u003e1\u003c/code\u003e, or by disabling critical security plugins through modification of the \u003ccode\u003eactive_plugins\u003c/code\u003e option. This vulnerability poses a significant risk as it can grant full control over affected WordPress sites to malicious actors.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access:\u003c/strong\u003e An authenticated attacker obtains or compromises credentials for a WordPress user with 'Shop Manager' capabilities or higher on the target site.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerability Identification:\u003c/strong\u003e The attacker identifies the privilege escalation vulnerability in the Wpify Woo plugin, specifically targeting the \u003ccode\u003eSettingsApi::save_option()\u003c/code\u003e REST route at \u003ccode\u003e/wp-json/wpify-woo/v1/option\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious Request Crafting:\u003c/strong\u003e The attacker crafts a HTTP POST request targeting the vulnerable REST endpoint. This request includes the \u003ccode\u003eoption\u003c/code\u003e parameter set to a sensitive WordPress option name (e.g., \u003ccode\u003edefault_role\u003c/code\u003e, \u003ccode\u003eusers_can_register\u003c/code\u003e, or \u003ccode\u003eactive_plugins\u003c/code\u003e) and the \u003ccode\u003edata\u003c/code\u003e parameter set to a value that facilitates privilege escalation (e.g., \u003ccode\u003eadministrator\u003c/code\u003e, \u003ccode\u003e1\u003c/code\u003e, or a serialized array to disable plugins).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRequest Execution:\u003c/strong\u003e The attacker sends the specially crafted POST request to the WordPress instance via the vulnerable REST API endpoint.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eOption Overwrite:\u003c/strong\u003e The vulnerable \u003ccode\u003eSettingsApi::save_option()\u003c/code\u003e function, lacking proper input validation and sanitization, calls \u003ccode\u003eupdate_option()\u003c/code\u003e with the attacker-controlled \u003ccode\u003eoption\u003c/code\u003e and \u003ccode\u003edata\u003c/code\u003e values, overwriting the legitimate WordPress setting.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePrivilege Escalation:\u003c/strong\u003e The targeted WordPress option is successfully overwritten, leading to an elevated privilege context. For example, \u003ccode\u003edefault_role\u003c/code\u003e is set to \u003ccode\u003eadministrator\u003c/code\u003e and \u003ccode\u003eusers_can_register\u003c/code\u003e to \u003ccode\u003e1\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAdministrator Account Creation/Activation:\u003c/strong\u003e The attacker then registers a new user account (if \u003ccode\u003eusers_can_register\u003c/code\u003e was enabled and \u003ccode\u003edefault_role\u003c/code\u003e set to administrator), or modifies an existing user's role to administrator.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFull Control:\u003c/strong\u003e The attacker gains full administrative control over the WordPress site, enabling further malicious activities such as arbitrary code execution, data exfiltration, or website defacement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-12736 grants authenticated attackers with 'Shop Manager' level access, or higher, full administrative control over the affected WordPress site. This means attackers can bypass security measures, create new administrator accounts, inject malicious code, deface the website, exfiltrate sensitive data, or install backdoors, leading to complete compromise of the web application and potentially the underlying server. While specific victim counts are not available, all WordPress installations running vulnerable versions of the Wpify Woo plugin are at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-12736\u003c/strong\u003e immediately by updating the Wpify Woo plugin to a version beyond 5.4.16 as soon as a fix is available.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy the Sigma rule\u003c/strong\u003e in this brief to your SIEM to detect exploitation attempts against the \u003ccode\u003e/wp-json/wpify-woo/v1/option\u003c/code\u003e REST route.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReview web server access logs\u003c/strong\u003e for suspicious POST requests to the \u003ccode\u003e/wp-json/wpify-woo/v1/option\u003c/code\u003e endpoint, especially those containing sensitive WordPress option names like \u003ccode\u003edefault_role\u003c/code\u003e, \u003ccode\u003eusers_can_register\u003c/code\u003e, or \u003ccode\u003eactive_plugins\u003c/code\u003e in the query string.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement Web Application Firewall (WAF)\u003c/strong\u003e rules to block or alert on requests to the \u003ccode\u003e/wp-json/wpify-woo/v1/option\u003c/code\u003e endpoint that attempt to modify core WordPress options, specifically looking for \u003ccode\u003eoption=\u003c/code\u003e and \u003ccode\u003edata=\u003c/code\u003e parameters with sensitive values.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T04:18:20Z","date_published":"2026-07-24T04:18:20Z","id":"https://feed.craftedsignal.io/briefs/2026-07-wpify-woo-privesc/","summary":"A privilege escalation vulnerability (CVE-2026-12736) in the Wpify Woo plugin for WordPress, affecting versions up to and including 5.4.16, allows authenticated attackers with 'Shop Manager' capabilities or higher to gain Administrator privileges by exploiting a REST route that overwrites arbitrary WordPress options.","title":"Wpify Woo Plugin Privilege Escalation Vulnerability (CVE-2026-12736)","url":"https://feed.craftedsignal.io/briefs/2026-07-wpify-woo-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Wpify Woo Plugin (\u003c= 5.4.16)","version":"https://jsonfeed.org/version/1.1"}