{
 "id": "WPSEC-2026-1781",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1781/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1781/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1781/index.md",
 "title": "Woocommerce Open Close – Best Business Schedules Manager <= 5.0.8 - Authenticated (Contributor+) Missing Authorization to Store Schedule Modification",
 "description": "The Open Close Store for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the 'woc_hour' schedule post type in all versions up to, and including, 5.0.8, due to the post type being registered with the default 'post' capability type and its schedule meta save handlers checking only a nonce or the generic edit_post capability instead of a store-management capability such as manage_woocommerce. This makes it possible for authenticated attackers with Contributor-level access and above to create store schedule records and set their open/close hours, which become the active store schedule when no other schedule exists. Attackers with Editor-level access can also modify or delete the active schedule, which controls when the store accepts orders.",
 "plugin": {
  "slug": "woc-open-close",
  "name": "Woocommerce Open Close – Best Business Schedules Manager",
  "full_name": "Open Close Store for WooCommerce – Business Hours & Order Scheduling",
  "wordpress_org": "https://wordpress.org/plugins/woc-open-close/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woc-open-close/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woc-open-close"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.0.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.0.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.0.9",
 "remediation": "Update to 5.0.9 or later.",
 "fix_released": "2026-10-26T20:26:03+00:00",
 "published": "2026-10-27T20:45:47+00:00",
 "updated": "2026-10-27T13:05:46.827559+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1781/",
  "https://plugins.svn.wordpress.org/woc-open-close/tags/5.0.9/",
  "https://wordpress.org/plugins/woc-open-close/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woc-open-close",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}