# Woocommerce Open Close – Best Business Schedules Manager <= 5.0.8 - Authenticated (Contributor+) Missing Authorization to Store Schedule Modification

- **ID:** WPSEC-2026-1781
- **Plugin:** Open Close Store for WooCommerce – Business Hours & Order Scheduling (`woc-open-close`), https://wordpress.org/plugins/woc-open-close/
- **Affected versions:** all versions before 5.0.9
- **Fixed in:** 5.0.9 (Update to 5.0.9 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woc-open-close
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1781/

## Description

The Open Close Store for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the 'woc_hour' schedule post type in all versions up to, and including, 5.0.8, due to the post type being registered with the default 'post' capability type and its schedule meta save handlers checking only a nonce or the generic edit_post capability instead of a store-management capability such as manage_woocommerce. This makes it possible for authenticated attackers with Contributor-level access and above to create store schedule records and set their open/close hours, which become the active store schedule when no other schedule exists. Attackers with Editor-level access can also modify or delete the active schedule, which controls when the store accepts orders.

## References

- https://wpsec.com/vuln/WPSEC-2026-1781/
- https://plugins.svn.wordpress.org/woc-open-close/tags/5.0.9/
- https://wordpress.org/plugins/woc-open-close/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1781/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.