CVE-2026-39800

Executive Summary

CVE-2026-39800 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting versions 1.24 and earlier of the "Additional Order Filters for WooCommerce" WordPress plugin. Because the flaw is exploitable without authentication and requires only user interaction, any site running the affected plugin exposes its administrative and customer-facing browsing sessions to script injection via crafted filter parameters. Successful exploitation enables session hijacking, credential theft, and full site takeover in the context of a victim's browser, with a CVSS v3.1 base score of 7.1 (High). No patch, workaround, public PoC, or Nuclei template is currently available; the plugin must be treated as unpatched and, if business-criticality does not justify continued operation, removed from production.

Technical Analysis

The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly referred to as Cross-Site Scripting. The affected component is a WordPress plugin that extends WooCommerce with additional order-filtering capabilities. The CNA title provided does not enumerate specific function names, REST routes, AJAX actions, query parameters, or file paths, so this analysis stays at the class and mechanism level rather than fabricating implementation specifics.

The critical characteristics, as derivable from the CVE data, are:

• Authentication boundary bypass (PR:N): The flaw is explicitly unauthenticated. This means the vulnerable input handler is reachable from the public internet without any login, nonce validation tied to a session, or capability check. In WordPress plugin ecosystems, unauthenticated XSS most commonly arises when filtering/rendering logic is registered via admin-ajax.php with the wp_ajax_nopriv_ hook, via a public REST API route with a permissive permission_callback, or via a shortcode/query-parameter path that executes for anonymous visitors.
• Scope change (S:C): The CVSS vector includes S:C (Changed Scope). This indicates the vulnerable component's exploitation can affect resources beyond its own security authority — i.e., injected script executes in a broader security context than the vulnerable plugin itself. In the WordPress context this typically means injected JavaScript runs in pages that carry the privileges and cookies of the hosting site's front end or admin area, enabling actions well outside the plugin's own scope.
• User interaction required (UI:R): Delivery is not fully automated. A victim must be induced to load a crafted page or click a crafted link for the payload to execute. This aligns with reflected or DOM-based XSS delivery patterns rather than stored mass-exploitation.
• Confidentiality/Integrity/Availability: Low (C:L/I:L/A:L): The impact is bounded — typical of client-side script injection where the attacker manipulates DOM content, reads cookies/tokens available to JavaScript, and performs state-changing requests as the victim, without direct server-side code execution or data destruction.
• Attack complexity: Low (AC:L): No race conditions, special positioning, or memory-layout constraints are involved. A straightforward crafted request/link suffices.

Because the plugin's purpose is order filtering within WooCommerce, the attack surface centers on order-query/filter inputs that are reflected into HTML and rendered to the requesting user without adequate output encoding or input sanitization. The precise parameter name and sanitization gap are not disclosed in the provided data.

WooCommerce order data is commercially sensitive (customer names, addresses, order contents, payment metadata). An XSS foothold in an authenticated administrator's browser is therefore a serious lateral-movement primitive, not merely a cosmetic defect.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (unauthenticated reflected/DOM XSS) and the CVSS vector.

1. Reconnaissance / target identification. An attacker enumerates WordPress sites running WooCommerce and fingerprints the installed plugin and its version (e.g., via publicly served plugin asset paths or version-identifying HTML). Targets at or below plugin version 1.24 are flagged.

2. Triggering the flaw class. The attacker constructs a URL or request in which a filter/order-related input is populated with a JavaScript payload. Per the CVSS vector (AV:N, PR:N), the endpoint accepts the input from an unauthenticated network client. Because the exact vulnerable parameter is not disclosed, the attacker would fuzz the plugin's public-facing filter inputs — query-string parameters and any publicly reachable AJAX or REST order-filter surface — to identify which reflected value is returned unencoded.

3. Payload execution. The victim is induced to visit the crafted link (drive-by, phishing, malicious ad, or social engineering). When the page renders, the injected script executes in the victim's browser context. Payloads at the class level range from cookie/session-token exfiltration to DOM manipulation, credential-harvesting overlays, or silent same-origin requests to WooCommerce admin actions.

4. Post-exploitation impact. With S:C scope change, the script operates beyond the plugin's own boundary — enabling theft of session cookies for privileged users, abuse of the victim's authenticated session to modify orders or settings, and, if an administrator is victimized, escalation toward full site compromise. The I:L/A:L subscores indicate the immediate integrity/availability effect is bounded per-victim, but the confidentiality of session material drives the overall 7.1 severity.

No exploit code, Nuclei template, or in-the-wild campaign is associated with this CVE in the provided intelligence.

Impact Assessment

• Affected systems: WordPress installations running WooCommerce with "Additional Order Filters for WooCommerce" plugin version 1.24 or earlier. Any publicly reachable storefront is in scope because the flaw is unauthenticated.
• Blast radius: All visitors and, more critically, authenticated users (shop managers and administrators) of an affected store can be targeted. Since WooCommerce stores hold order and customer PII, a compromised admin session can expose the entire order database and payment configuration.
• CVSS interpretation: Base score 7.1 (High). AV:N makes it internet-reachable; AC:L and PR:N make it cheap to attempt at scale; UI:R limits it to victims who can be lured to a crafted page; S:C widens impact beyond the plugin; C:L/I:L/A:L caps per-incident damage but permits session theft and unauthorized actions.
• Business impact: customer trust erosion, potential PCI-DSS concerns for stores handling card data flows, regulatory exposure under GDPR/CCPA for PII leakage, and operational cost of incident response and storefront remediation.
• EPSS: Not yet scored by FIRST.org — no exploit-probability estimate is available; do not assume low likelihood purely from absence of a public exploit.
• KEV: Not listed in CISA KEV; no confirmed active exploitation per provided data.

Detection Guidance

Sigma Rule

title: Potential Unauthenticated XSS Attempt Against WooCommerce Order Filters Plugin
id: 6f0e2b7a-8c41-4d9a-9b3e-1f2a7c5d8e10
status: experimental
description: Detects requests containing script-like payloads in query parameters targeting WooCommerce additional order filter functionality
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-39800
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-json/'
      - '/wp-content/plugins/additional-order-filters-for-woocommerce/'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'document.cookie'
      - 'svg/onload'
  condition: selection_method and selection_uri and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Security scanners and fuzzing tools
  - Legitimate form submissions containing HTML entities
level: high
tags:
  - attack.t1189
  - cve.2026.39800

YARA Rule

rule CVE_2026_39800_WooCommerce_OrderFilters_XSS
{
    meta:
        description = "Detects XSS payload patterns targeting Additional Order Filters for WooCommerce <= 1.24"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-39800"
        date = "2026-01-01"
        cve = "CVE-2026-39800"

    strings:
        $plugin = "additional-order-filters-for-woocommerce" ascii nocase
        $s1 = "<script" ascii nocase
        $s2 = "javascript:" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "document.cookie" ascii nocase
        $s6 = "svg/onload" ascii nocase
        $s7 = "String.fromCharCode" ascii nocase

    condition:
        uint16(0) == 0x3C3F or
        (any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7)) or
        ($plugin and any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-39800 WooCommerce Additional Order Filters Unauthenticated XSS Attempt"; flow:established,to_server; http.uri; content:"additional-order-filters-for-woocommerce"; nocase; http.uri; content:"<script"; nocase; http.uri; content:"%3Cscript"; nocase; http.uri; content:"javascript:"; nocase; classtype:web-application-attack; reference:cve,2026-39800; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-39800; sid:2026398001; rev:1;)

alert http any any -> any any (msg:"CVE-2026-39800 WooCommerce Order Filter XSS Payload in Query"; flow:established,to_server; http.uri; content:"admin-ajax.php"; nocase; http.uri; content:"onerror="; nocase; http.uri; content:"document.cookie"; nocase; classtype:web-application-attack; reference:cve,2026-39800; sid:2026398002; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and
    url.path : ("*admin-ajax.php*", "*wp-json*", "*additional-order-filters-for-woocommerce*") and
    url.query : ("*<script*", "*%3Cscript*", "*javascript:*", "*onerror=*", "*onload=*", "*document.cookie*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_full = uri . "?" . uri_query
| where match(uri_full, "(?i)(additional-order-filters-for-woocommerce|admin-ajax\.php|wp-json)")
| where match(uri_full, "(?i)(<script|%3Cscript|javascript:|onerror=|onload=|document\.cookie|svg/onload)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_full) as payloads by src_ip, status
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve_2026_39800,">
  <rule id="2026398" level="10">
    <if_sid>31100</if_sid>
    <id>^2026398001$|^2026398002$</id>
    <description>CVE-2026-39800: Unauthenticated XSS attempt against WooCommerce Additional Order Filters plugin detected</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
  <rule id="2026399" level="12">
    <if_sid>31100</if_sid>
    <url>additional-order-filters-for-woocommerce|admin-ajax\.php|wp-json</url>
    <regex type="pcre2">(?i)(%3Cscript|<script|javascript:|onerror=|onload=|document\.cookie)</regex>
    <description>CVE-2026-39800: XSS payload observed in order filter request to plugin endpoint</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, patch version, or official workaround is evidenced in any tracked source. Treat version 1.24 and earlier as permanently vulnerable until a fixed release is verified.

1. Immediate mitigations

   • If the plugin is not actively required for store operations, deactivate and remove it. Absent a patch, removal is the only fully effective mitigation.
   • If continued operation is unavoidable, place the storefront behind a WAF and deploy virtual patching rules that block script-signature payloads (<script, javascript:, event-handler attributes such as onerror=/onload=) on all filter-related query parameters and on requests to admin-ajax.php, REST routes (/wp-json/), and the plugin's asset paths.
   • Enforce a strict Content-Security-Policy with script-src restricted to trusted origins and avoid unsafe-inline; this materially reduces XSS impact even when input handling is unsafe.
   • Set session cookies with HttpOnly and Secure attributes and confirm SameSite policy to reduce session-token theft. (Note: HttpOnly does not stop DOM manipulation or rider-requests but restricts cookie exfiltration.)
   • Restrict administrator browsing: never browse the storefront from an admin session, and enforce distinct admin-only browsers/VMs to limit admin-side exposure to reflected payloads.

2. Patch / upgrade steps

   • Monitor the plugin vendor's distribution channel for a fixed release exceeding version 1.24. As of this writing none exists.
   • When a patched version is published, validate it in staging, back up the database and files, then update. Verify the version after update and re-scan.
   • Because no patch source is tracked, also monitor WordPress.org plugin repository status — plugins are frequently closed for security review, which is itself a signal.

3. Long-term hardening

   • Apply a policy of reviewing and minimizing third-party plugin inventory; unmaintained or unpatched plugins should be retired.
   • Implement automated vulnerability scanning against the site's plugin manifest, with alerting on newly disclosed CVEs.
   • Adopt defense-in-depth: WAF with virtual patching, strict CSP, least-privilege WordPress roles, Web Application Firewall logging forwarded to SIEM, and regular security review of order-export and customer data flows.
   • Establish an incident playbook for XSS in WooCommerce contexts: force password resets, rotate WordPress salts/keys to invalidate sessions, audit recent admin actions and order modifications, and notify affected customers if PII exposure is confirmed.

References

• NVD — CVE-2026-39800: https://nvd.nist.gov/vuln/detail/CVE-2026-39800
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• FIRST EPSS (no score currently published): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-39800 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• OWASP — Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html