{
 "id": "WPSEC-2026-2262",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2262/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2262/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2262/index.md",
 "title": "ActiveCampaign for WooCommerce <= 2.11.3 - Missing Authorization to Authenticated (Subscriber+) Sync Management Actions",
 "description": "The ActiveCampaign for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via several AJAX actions in all versions up to, and including, 2.11.3, due to missing capability checks (and missing nonce checks) on handlers such as schedule_bulk_historical_sync, stop_historical_sync, reset_historical_sync, run_product_sync, handle_cancel_sync, handle_reset_sync_status, handle_abandon_cart_sync and handle_reset_abandon_cart_sync. This makes it possible for authenticated attackers, with subscriber-level access and above, to start, pause, cancel or reset the historical order sync and the product sync, trigger the abandoned cart sync, and reset failed abandoned cart records.",
 "plugin": {
  "slug": "activecampaign-for-woocommerce",
  "name": "ActiveCampaign for WooCommerce",
  "full_name": "ActiveCampaign for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/activecampaign-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/activecampaign-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/activecampaign-for-woocommerce"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.0.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.0.0",
 "remediation": "Update to 3.0.0 or later.",
 "fix_released": "2026-11-02T07:13:50+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:22:04.817711+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2262/",
  "https://plugins.svn.wordpress.org/activecampaign-for-woocommerce/tags/3.0.0/",
  "https://wordpress.org/plugins/activecampaign-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/activecampaign-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}