{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31921", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-10T10:59:45.899Z", "datePublished": "2026-03-25T16:14:57.217Z", "dateUpdated": "2026-03-26T19:48:34.347Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "products-rearrange-woocommerce", "product": "Product Rearrange for WooCommerce", "vendor": "Devteam HaywoodTech", "versions": [{"lessThanOrEqual": "<= 1.2.2", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "hivesec | Patchstack Bug Bounty Program"}], "datePublic": "2026-03-25T17:12:36.365Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.</p>"}], "value": "Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:57.217Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/products-rearrange-woocommerce/vulnerability/wordpress-product-rearrange-for-woocommerce-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T19:48:09.053790Z", "id": "CVE-2026-31921", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:48:34.347Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-31921", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T19:48:09.053790Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:46:50.228Z"}}], "cna": {"title": "WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "hivesec | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Devteam HaywoodTech", "product": "Product Rearrange for WooCommerce", "versions": [{"status": "affected", "version": "n/a", "versionType": "custom", "lessThanOrEqual": "<= 1.2.2"}], "packageName": "products-rearrange-woocommerce", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-03-25T17:12:36.365Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/products-rearrange-woocommerce/vulnerability/wordpress-product-rearrange-for-woocommerce-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:57.217Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31921", "state": "PUBLISHED", "dateUpdated": "2026-03-26T19:48:34.347Z", "dateReserved": "2026-03-10T10:59:45.899Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-25T16:14:57.217Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Rearrange for WooCommerce: from n/a through <= 1.2.2."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Product Rearrange for WooCommerce: desde n/a hasta &lt;= 1.2.2."}], "id": "CVE-2026-31921", "lastModified": "2026-03-26T20:16:11.907", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-25T17:16:58.913", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/products-rearrange-woocommerce/vulnerability/wordpress-product-rearrange-for-woocommerce-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Product Rearrange for WooCommerce", "source": "cna", "vendor": "Devteam HaywoodTech"}, "product": "product_rearrange_for_woocommerce", "vendor": "devteam_haywoodtech"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-25T18:38:49.984544+00:00", "value": {"mitigation_remediation": ["Upgrade Product Rearrange for WooCommerce to version 1.2.3 or later", "Verify that the installed plugin version is no longer affected", "If an update is not immediately possible, disable or remove the plugin to eliminate the attack surface", "Review WooCommerce user roles to ensure only administrators have permission to manage products"], "summary": {"action": "Immediate patch", "impact": "Unauthorized access to protected plugin features"}, "threat_synthesis": {"affected_systems": "The flaw affects Devteam HaywoodTech\u2019s Product Rearrange for WooCommerce plugin from all earlier releases through version 1.2.2. Anyone using a vulnerable instance of the plugin, regardless of their specific WooCommerce configuration, is potentially impacted.", "description_and_impact": "The vulnerability is a missing authorization flaw in the Product Rearrange for WooCommerce plugin that allows attackers to bypass intended access controls. This enables unauthorized modification or rearrangement of WooCommerce products, potentially altering pricing, display order, or affecting customer experience. The weakness stems from improperly configured security levels that do not enforce proper role checks before executing critical functions.", "risk_and_exploitability": "EPSS data is not available and the vulnerability is not listed in the KEV catalog, but the absence of authorization checks suggests a high likelihood of exploitation over the web. Attackers can likely trigger the vulnerable functions by sending crafted HTTP requests to the plugin\u2019s endpoints; authenticated or unauthenticated users with basic access may be able to invoke the affected actions. Failure to patch could lead to unauthorized product changes, data tampering, and increased exposure to further attacks."}}}}, "created": "2026-03-25T21:43:46.252739+00:00", "updated": "2026-03-26T11:37:44.971118+00:00", "vendors": ["devteam_haywoodtech", "devteam_haywoodtech$PRODUCT$product_rearrange_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}