CVE-2026-27066

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27066", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "REJECTED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-17T13:23:42.768Z", "datePublished": "2026-02-19T08:27:11.001Z", "dateUpdated": "2026-06-11T12:41:41.473Z", "dateRejected": "2026-06-11T12:41:41.473Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-06-11T12:41:41.473Z"}, "rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}]}], "x_generator": {"engine": "Vulnogram 1.0.2"}}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27066", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "REJECTED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-17T13:23:42.768Z", "datePublished": "2026-02-19T08:27:11.001Z", "dateUpdated": "2026-06-11T12:41:41.473Z", "dateRejected": "2026-06-11T12:41:41.473Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-06-11T12:41:41.473Z"}, "rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}]}], "x_generator": {"engine": "Vulnogram 1.0.2"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}], "id": "CVE-2026-27066", "lastModified": "2026-10-16T14:10:00.120", "metrics": {}, "published": "2026-02-19T09:16:27.360", "references": [], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Rejected"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.46]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Live sales notification for WooCommerce", "source": "cna", "vendor": "PI Web Solution"}, "product": "live_sales_notification_for_woocommerce", "vendor": "pi_web_solution"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-29T02:31:45.142283+00:00", "value": {"mitigation_remediation": ["Upgrade the Live sales notification for WooCommerce plugin to a version newer than 2.3.60.", "Restrict direct access to the WordPress administrative pages that expose sale notifications, limiting them to users with appropriate roles.", "Enforce WordPress role\u2011based access controls so that only authorized administrators can view sale notification data."], "summary": {"action": "Patch", "impact": "Unauthorized access to notification data"}, "threat_synthesis": {"affected_systems": "WordPress sites that install PI Web Solution Live sales notification for WooCommerce in any version up to and including 2.3.60 are vulnerable. The vulnerability affects all releases of the plugin from the earliest mentioned build through 2.3.60.", "description_and_impact": "The vulnerability is a missing authorization issue in PI Web Solution Live sales notification for WooCommerce. It allows actors to bypass the plugin\u2019s configured access control security levels and retrieve sale notifications. This can result in unauthorized disclosure of notification data stored by the plugin.", "risk_and_exploitability": "Based on the CVSS base score of 5.3, the vulnerability represents a moderate risk. The EPSS score is less than 1\u202f%, indicating a low probability of exploitation, and it is not listed in CISA\u2019s KEV catalog. The likely attack vector is via the WordPress administrative interface or through an authenticated user with insufficient role restrictions, allowing read access to sale notification data that should otherwise be protected."}}}}, "created": "2026-02-20T10:08:02.376192+00:00", "updated": "2026-04-29T02:45:35.961004+00:00", "vendors": ["pi_web_solution", "pi_web_solution$PRODUCT$live_sales_notification_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}