WordPress plugin
WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 5 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium3
- Low0
All WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High8.0 | Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint ≤5.4.16Update to 5.4.17 | CVE-2026-12736 | |
| High8.8 | Authenticated (Contributor+) Arbitrary File Upload ≤5.4.1Update to 5.4.2 | CVE-2026-42748 |
- High8.0Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
≤5.4.16Update to 5.4.17
- High8.8Authenticated (Contributor+) Arbitrary File Upload
≤5.4.1Update to 5.4.2
WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce: common questions
Does WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce have known vulnerabilities?
Yes. VulnCrest Radar lists 5 known vulnerabilities in WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce: 2 high, 3 medium. None are known to affect version null.
How do I check which version of WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce vulnerability?
CVE-2026-12736, published Jul 23, 2026: WPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint. Severity: High (CVSS 8.0).
Is any WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce vulnerability listed in CISA KEV?
No. None of the known WPify Woo – Withdrawal, CRN/VAT, QR payments, Heureka and more for WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.