Description
The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the save_option() function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or reset(delete) the plugin's settings.
Published: 2026-09-24
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated export and reset of plugin settings can lead to data loss and potential exposure of configuration data
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is caused by a missing capability check in the plugin’s save_option() routine, allowing any user to invoke export or reset of the plugin’s configuration. This results in a loss of stored settings and the possibility that configuration data could be exposed through the export function. The weakness is an Authorization flaw (CWE‑862).

Affected Systems

WordPress sites that have installed the Custom Thank You Page for WooCommerce plugin in any version up to 1.1.2 are affected. The vulnerability applies to the entire range of versions from the first release through 1.1.2; no specific sub‑versions beyond 1.1.2 are enumerated.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalogue. Attackers do not need authentication and only require access to the site’s web interface to exploit the missing permission check, making the vulnerability readily exploitable.

Generated by OpenCVE AI on September 24, 2026 at 12:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Custom Thank You Page for WooCommerce plugin to version 1.1.3 or later, which includes a proper capability check.
  • If an upgrade cannot be performed immediately, temporarily disable or remove the plugin to block unauthorized export or reset commands.
  • Audit other plugins and themes for similar missing capability checks and apply updates or hardening recommendations to prevent future authorization weaknesses.

Generated by OpenCVE AI on September 24, 2026 at 12:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Alexvtn
Alexvtn custom Thank You Page For Woocommerce
Wordpress-extensions
Wordpress-extensions custom Thank You Page For Woocommerce
Vendors & Products Alexvtn
Alexvtn custom Thank You Page For Woocommerce
Wordpress-extensions
Wordpress-extensions custom Thank You Page For Woocommerce

Thu, 24 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the save_option() function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or reset(delete) the plugin's settings.
Title Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Alexvtn Custom Thank You Page For Woocommerce
Wordpress-extensions Custom Thank You Page For Woocommerce
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-24T15:14:17.534Z

Reserved: 2026-03-25T12:20:08.456Z

Link: CVE-2026-4806

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-24T12:17:12.307

Modified: 2026-09-24T16:17:07.523

Link: CVE-2026-4806

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T19:43:24Z

Weaknesses