Empik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action
medium
The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, t...
- CVSS:
- 4.3
(Wordfence)
- Affected:
- up to 1.5.1
- Fixed in:
- 1.5.2
- Disclosed:
- Sep 18, 2026
CVE-2026-9766 on NVD →
EmpikPlace for Woocommerce <= 1.4.3 - Authenticated (Subscriber+) PHP Object Injection
high
The EmpikPlace for Woocommerce plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in t...
- CVSS:
- 8.8
(Wordfence)
- Affected:
- up to 1.4.3
- Fixed in:
- 1.4.5
- Disclosed:
- Apr 10, 2025
CVE-2025-32568 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database