CVE-2024-1516: Zao Wp Ecommerce

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_for_saas_push() function in all versions up to, and including, 3.15.1. This makes it possible for unauthenticated attackers to create arbitrary posts with arbitrary content.

Affected products

• Zao Wp Ecommerce: up to and including 3.15.1

Published 2024-02-28. Last modified 2026-06-17.