Exploitation Research Plan - CVE-2026-56013

1. Vulnerability Summary

The License Manager for WooCommerce plugin (versions <= 3.0.15) is vulnerable to an Unauthenticated Insecure Direct Object Reference (IDOR). The vulnerability exists in the plugin's REST API endpoints (specifically those related to Generators and Licenses) and potentially its global action handlers. Due to an insufficiently restrictive permission_callback in the RestController and missing authorization checks within specific endpoint callbacks (like deleteGenerator or updateGenerator), unauthenticated users can perform actions on resources (generators, licenses, or activations) by simply providing their ID.

2. Attack Vector Analysis

• Endpoint: /wp-json/lmfwc/v2/generators/{generator_id} or /wp-json/lmfwc/v2/licenses/{license_id}
• HTTP Methods: DELETE, PUT, or GET.
• Payload Parameter: {generator_id} or {license_id} in the URL path.
• Authentication: None (Unauthenticated).
• Preconditions: The specific REST route must be enabled in the plugin settings (checked via isRouteEnabled). By default, many are enabled for functionality.

3. Code Flow

1. Route Registration: In includes/Api/V2/Generators.php, the register_routes() method registers the DELETE method for `generators/(?P<