CVE-2026-66466

The CVSS 7.5 / EPSS 0.00246 split in this disclosure invites lazy interpretation: high severity but low exploitation probability, so deprioritize. That's the wrong takeaway. For WooCommerce plugin vulnerabilities, this divergence more likely signals a tooling gap than a threat gap — and the 2026 CVE identifier compounds the problem by suggesting this is either a retrospective filing or a placeholder, which changes what you're actually defending against. Start by verifying whether the affected plugin (BOGO Smart Sales Booster at version 2.1.1 and below) is still installed in your environment. The 2026 date is a reliable signal that this may be abandoned or semi-abandoned code — plugins in this maintenance state don't disappear; they get bundled into hosting stacks, inherited through theme purchases, or copy-pasted into custom implementations that never get audited. You may be running this without knowing it. The access control boundary is the critical unknown. The CVE labels this Broken Access Control, but the business risk depends entirely on what the BOGO logic touches. If it's limited to cart pricing manipulation, the impact is financial (pricing rule abuse, promotion bypass). If it extends to customer data, order state, or checkout flow, the impact crosses into data exposure territory — which would push the actual risk well above what CVSS captures. Check what data the plugin's PHP classes load and whether pricing hooks operate before or after session authentication checks. The exploitation economics differ from traditional infrastructure CVEs. WooCommerce BOGO manipulation is profitable at scale even at small per-transaction gains — automated scanners miss this because exploitation manifests as abnormal purchasing behavior, not server compromise. The low EPSS reflects that current scanner signatures don't cover this pattern, not that attackers can't or won't exploit it. Historical CVE genealogy in the WooCommerce plugin ecosystem shows a consistent lag: high CVSS, low EPSS, then 3-6 months later scanner signatures drop and automated exploitation begins. The EPSS will likely converge toward exploitation reality as tooling catches up. Prioritize: inventory what WooCommerce plugins you run, verify this one's maintenance status, and treat the access control boundary as untrusted until you can confirm pricing hooks fire after session validation — not before.

Reviewed through automated stages and approved by a human before publication.