Cyber Posture

CVE-2026-31921

High

Published: 25 March 2026

Published
25 March 2026
Modified
24 April 2026
KEV Added
Patch
CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS Score 0.0006 17.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-31921 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly enforces approved authorizations for access to system resources, preventing unauthenticated exploitation of the missing authorization in the WooCommerce plugin.

prevent

Requires timely identification, reporting, and correction of flaws like this specific missing authorization vulnerability in the Product Rearrange plugin.

prevent

Limits privileges to the least necessary, reducing the impact of unauthorized actions enabled by the plugin's broken access control.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Missing authorization (CWE-862) in public-facing WooCommerce plugin directly enables remote unauthenticated exploitation of the web application (T1190); high availability impact via application manipulation maps to T1499.004 Application or System Exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.

Deeper analysisAI

CVE-2026-31921 is a missing authorization vulnerability (CWE-862) in the Product Rearrange for WooCommerce WordPress plugin by Devteam HaywoodTech. It enables exploitation of incorrectly configured access control security levels and affects all versions of the plugin from n/a through 1.2.2.

The vulnerability has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), indicating it is exploitable remotely over the network by unauthenticated attackers with low attack complexity and no user interaction. Successful exploitation allows low-impact integrity violations, such as limited data modification, alongside high-impact availability disruptions, potentially leading to denial-of-service conditions.

The Patchstack advisory documents this broken access control issue in Product Rearrange for WooCommerce version 1.2.2 and provides further details at https://patchstack.com/database/Wordpress/Plugin/products-rearrange-woocommerce/vulnerability/wordpress-product-rearrange-for-woocommerce-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve.

Details

CWE(s)

CVEs Like This One

CVE-2026-0490Shared CWE-862
CVE-2026-27388Shared CWE-862
CVE-2025-69340Shared CWE-862
CVE-2026-25317Shared CWE-862
CVE-2024-13655Shared CWE-862
CVE-2026-32441Shared CWE-862
CVE-2026-25242Shared CWE-862
CVE-2026-30970Shared CWE-862
CVE-2025-67974Shared CWE-862
CVE-2026-28254Shared CWE-862

References