Woocommerce Open Close – Best Business Schedules Manager <= 5.0.8 - Authenticated (Contributor+) Missing Authorization to Store Schedule Modification
- ID
- WPSEC-2026-1781
- Plugin
- Open Close Store for WooCommerce – Business Hours & Order Scheduling (woc-open-close)
- Affected
- all versions before 5.0.9
- Remediation
- Update to 5.0.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Woocommerce Open Close – Best Business Schedules Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Open Close Store for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the 'woc_hour' schedule post type in all versions up to, and including, 5.0.8, due to the post type being registered with the default 'post' capability type and its schedule meta save handlers checking only a nonce or the generic edit_post capability instead of a store-management capability such as manage_woocommerce. This makes it possible for authenticated attackers with Contributor-level access and above to create store schedule records and set their open/close hours, which become the active store schedule when no other schedule exists. Attackers with Editor-level access can also modify or delete the active schedule, which controls when the store accepts orders.
References
- https://wpsec.com/vuln/WPSEC-2026-1781/
- https://plugins.svn.wordpress.org/woc-open-close/tags/5.0.9/
- https://wordpress.org/plugins/woc-open-close/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS