Description
Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.
Published: 2026-04-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access
Action: Patch Now
AI Analysis

Impact

The vulnerability arises from a missing authorization check in the Book Previewer for Woocommerce plugin, allowing users who are not supposed to have access to invoke preview functionality. This flaw results in unauthorized access to plugin features, formally identified as CWE‑862.

Affected Systems

The affected product is the g5theme Book Previewer for Woocommerce WordPress plugin, with all releases up to and including version 1.0.6 impacted. No other vendors or products are listed as affected.

Risk and Exploitability

The CVSS base score of 5.3 indicates medium severity, and an EPSS score of less than 1 % suggests a very low likelihood of exploitation. The vulnerability is not recorded in CISA’s KEV catalog. Based on the description, it is inferred that the most likely attack vector is via the web interface of the WordPress site, where an attacker could interact with the plugin’s preview functionality without needing valid authentication.

Generated by OpenCVE AI on April 8, 2026 at 23:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Book Previewer for Woocommerce plugin to a version newer than 1.0.6.
  • If an upgrade cannot be performed immediately, deactivate or uninstall the plugin to eliminate the exposed access control flaw.
  • After patching or removal, review WordPress role and capability settings to ensure that preview features are only available to authorized users.

Generated by OpenCVE AI on April 8, 2026 at 23:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Apr 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared G5theme
G5theme book Previewer For Woocommerce
Wordpress
Wordpress wordpress
Vendors & Products G5theme
G5theme book Previewer For Woocommerce
Wordpress
Wordpress wordpress

Wed, 08 Apr 2026 08:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.
Title WordPress Book Previewer for Woocommerce plugin <= 1.0.6 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

G5theme Book Previewer For Woocommerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-29T09:52:03.848Z

Reserved: 2026-04-07T10:57:59.671Z

Link: CVE-2026-39668

cve-icon Vulnrichment

Updated: 2026-04-08T19:59:18.743Z

cve-icon NVD

Status : Deferred

Published: 2026-04-08T09:16:38.170

Modified: 2026-04-24T18:06:04.160

Link: CVE-2026-39668

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-09T08:28:10Z

Weaknesses