Security Advisory - Published 2026-06-22 - WordPress / WooCommerce
Ultimate WooCommerce Auction Pro CVE-2026-4259: check auction pages and admin activity
Ultimate WooCommerce Auction Pro through 2.4.5 has a reflected XSS issue that matters most when store administrators open affected links while logged in. Patch or disable the plugin, then review admin sessions and recent auction-page traffic.
Affected version
| CVE | Product | Affected | CVSS |
|---|---|---|---|
| CVE-2026-4259 | Ultimate WooCommerce Auction Pro | through 2.4.5 | 7.1 |
Owner self-check
wp plugin list --path=/var/www/html 2>/dev/null | grep -i 'auction\\|woocommerce'
grep -Rni 'ultimate-woocommerce-auction-pro\\|woocommerce auction\\|auction pro' wp-content/plugins wp-content/debug.log 2>/dev/null | head -80
grep -Rni 'wp-login.php\\|wp-admin\\|auction' /var/log/nginx /var/log/apache2 2>/dev/null | tail -150
find wp-content/plugins wp-content/uploads -type f -mtime -10 -print 2>/dev/null | head -120What to review
- Installed plugin version and whether Ultimate WooCommerce Auction Pro is active on public auction pages.
- Admin users who clicked links from email, chat, support tickets, or referral traffic during the exposure window.
- Unexpected administrator actions, plugin setting changes, new users, injected snippets, and edited theme files.
- WooCommerce orders, auction listings, payment settings, and recent checkout or redirect behavior.
Safe fix path
- Patch to the vendor-fixed version when available. If no fixed build is installed, disable the plugin until reviewed.
- Keep admin users out of unknown links while logged in. Use a clean browser profile for emergency review.
- Rotate administrator passwords and active sessions if a suspicious admin click is confirmed.
- Preserve web logs, WordPress audit logs, WooCommerce order history, and file timestamps before cleanup.
Repair help
Use Ping7 CVE Repair when the store has active auctions, admin users opened suspicious links, checkout settings changed, or you need a clean review before returning the plugin to production.