CVE-2026-106608: Automattic Woocommerce

High severity, CVSS 7.2.

Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

Affected products

• Automattic Woocommerce: from 9.8.0, up to and including 11.1.2

Published 2026-10-10. Last modified 2026-10-10.