UNKNOWN NVD

CVE-2026-109926

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on e

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.

References

https://wpscan.com/vulnerability/a85ad939-3eb3-470b-a938-d0bfff1ee24f/

Published: 2026-10-21 · Source: NVD · Feed updated: 2026-10-21

This unknown severity vulnerability was published on 2026-10-21 via NVD.

vulnfeed aggregates 17594 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.