CVE-2026-90985: Unknown Wpc Smart Compare For Woocommerce

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products.

Affected products

• Unknown Wpc Smart Compare For Woocommerce: before 6.6.1 (fixed in 6.6.1)

Published 2026-09-23. Last modified 2026-09-23.