{"id":"CVE-2026-39723","published":"2026-10-06T06:17:00.947","lastModified":"2026-10-08T17:17:16.760","description":"Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wc-gateway-greeninvoice/vulnerability/wordpress-morning-for-woocommerce-plugin-2-4-1-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to bypass authorization controls in the Green Invoice Morning for WooCommerce plugin, enabling them to perform actions they shouldn't be able to access. The flaw stems from incorrectly configured access control security levels that leave critical functionality exposed.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be performed remotely with minimal preconditions, making it highly attractive to attackers.","blast_radius":"If exploited, this vulnerability could allow unauthorized users to manipulate WooCommerce order processing, invoice generation, or other financial operations, potentially leading to financial losses or data manipulation across affected e-commerce sites.","remediation":"Upgrade to version 2.4.2 or later to remediate the missing authorization controls in the Green Invoice Morning for WooCommerce plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authorization","woocommerce","ecommerce","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:02:25.168Z"}}