# ActiveCampaign for WooCommerce <= 2.11.3 - Missing Authorization to Authenticated (Subscriber+) Sync Management Actions

- **ID:** WPSEC-2026-2262
- **Plugin:** ActiveCampaign for WooCommerce (`activecampaign-for-woocommerce`), https://wordpress.org/plugins/activecampaign-for-woocommerce/
- **Affected versions:** all versions before 3.0.0
- **Fixed in:** 3.0.0 (Update to 3.0.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/activecampaign-for-woocommerce
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2262/

## Description

The ActiveCampaign for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via several AJAX actions in all versions up to, and including, 2.11.3, due to missing capability checks (and missing nonce checks) on handlers such as schedule_bulk_historical_sync, stop_historical_sync, reset_historical_sync, run_product_sync, handle_cancel_sync, handle_reset_sync_status, handle_abandon_cart_sync and handle_reset_abandon_cart_sync. This makes it possible for authenticated attackers, with subscriber-level access and above, to start, pause, cancel or reset the historical order sync and the product sync, trigger the abandoned cart sync, and reset failed abandoned cart records.

## References

- https://wpsec.com/vuln/WPSEC-2026-2262/
- https://plugins.svn.wordpress.org/activecampaign-for-woocommerce/tags/3.0.0/
- https://wordpress.org/plugins/activecampaign-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2262/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.