WooCommerce Product Configurator Bypasses Authorization Checks

The Product Configurator for WooCommerce plugin before version 1.7.3 contains a critical authorization bypass vulnerability in its AJAX endpoints. The plugin fails to validate user permissions or check post status before exposing sensitive product data—including pricing, SKU information, weight, and stock status—through publicly accessible functions. Attackers can enumerate private and draft products by simply supplying product IDs, completely circumventing WordPress's native post-visibility controls. This affects any e-commerce site using the vulnerable plugin, exposing confidential product information, pricing strategies, and unreleased inventory to unauthenticated users.

While CVE-2026-11568 maps to zero MITRE ATT&CK techniques in the current framework, Casky's extended reasoning capabilities would detect the attack chain underlying this vulnerability through several critical patterns: Improper Input Validation (T1190 precursor), Unauthorized Information Disclosure (related to T1526 - Enumerate Cloud Resources applied to plugin APIs), and Privilege Escalation via Broken Access Control. A practitioner using Casky would observe findings highlighting unauthenticated AJAX function calls lacking capability checks, direct database queries returning restricted post types, and absence of nonce verification. The platform's 754 security skills would flag insecure direct object references (IDOR) patterns, missing authorization middleware, and overly permissive AJAX handlers—enabling practitioners to identify similar authorization bypasses across their WordPress ecosystem before exploitation occurs.