CVE-2026-3589 - WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF

CVE ID : CVE-2026-3589 Published : March 6, 2026, 9:11 a.m. | 48 minutes ago Description : The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...