CVE-2026-31921
Published: 25 March 2026
Summary
CVE-2026-31921 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations for access to system resources, preventing unauthenticated exploitation of the missing authorization in the WooCommerce plugin.
Requires timely identification, reporting, and correction of flaws like this specific missing authorization vulnerability in the Product Rearrange plugin.
Limits privileges to the least necessary, reducing the impact of unauthorized actions enabled by the plugin's broken access control.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in public-facing WooCommerce plugin directly enables remote unauthenticated exploitation of the web application (T1190); high availability impact via application manipulation maps to T1499.004 Application or System Exploitation.
NVD Description
Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.
Deeper analysisAI
CVE-2026-31921 is a missing authorization vulnerability (CWE-862) in the Product Rearrange for WooCommerce WordPress plugin by Devteam HaywoodTech. It enables exploitation of incorrectly configured access control security levels and affects all versions of the plugin from n/a through 1.2.2.
The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low attack complexity and no user interaction. Successful exploitation allows low-impact integrity violations, such as limited data modification, alongside high-impact availability disruptions, potentially leading to denial-of-service conditions.
The Patchstack advisory documents this broken access control issue in Product Rearrange for WooCommerce version 1.2.2 and provides further details at https://patchstack.com/database/Wordpress/Plugin/products-rearrange-woocommerce/vulnerability/wordpress-product-rearrange-for-woocommerce-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve.
Details
- CWE(s)