CVE-2026-86785: Unknown Social Commerce For Woocommerce

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.

Affected products

• Unknown Social Commerce For Woocommerce: up to and including 2.5.4

Published 2026-09-23. Last modified 2026-09-23.