ActiveCampaign for WooCommerce <= 2.11.3 - Missing Authorization to Authenticated (Subscriber+) Sync Management Actions
- ID
- WPSEC-2026-2262
- Plugin
- ActiveCampaign for WooCommerce (activecampaign-for-woocommerce)
- Affected
- all versions before 3.0.0
- Remediation
- Update to 3.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- ActiveCampaign for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The ActiveCampaign for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via several AJAX actions in all versions up to, and including, 2.11.3, due to missing capability checks (and missing nonce checks) on handlers such as schedule_bulk_historical_sync, stop_historical_sync, reset_historical_sync, run_product_sync, handle_cancel_sync, handle_reset_sync_status, handle_abandon_cart_sync and handle_reset_abandon_cart_sync. This makes it possible for authenticated attackers, with subscriber-level access and above, to start, pause, cancel or reset the historical order sync and the product sync, trigger the abandoned cart sync, and reset failed abandoned cart records.
References
- https://wpsec.com/vuln/WPSEC-2026-2262/
- https://plugins.svn.wordpress.org/activecampaign-for-woocommerce/tags/3.0.0/
- https://wordpress.org/plugins/activecampaign-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS