Privilege elevation in Microsoft Teams lets a remote, unauthenticated attacker gain unauthorized access across a network due to a missing authorization check (CWE-862). The maximum 10.0 CVSS rating stems from a changed scope with high confidentiality and integrity impact, meaning the flaw reaches resources beyond the initially vulnerable component. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect-score, no-precondition profile makes it a top-tier patch priority.
Remote code execution in Microsoft Azure Service Bus lets an already-authorized (PR:L) attacker send maliciously crafted serialized data that the service deserializes without validation (CWE-502), executing attacker-controlled code across the network. The scope-changed CVSS 9.9 rating reflects that code execution can break out of the caller's authorization boundary into the underlying managed-service host, threatening confidentiality, integrity, and availability of the messaging infrastructure. There is no public exploit identified at time of analysis, but the near-maximal severity and cloud-hosted, multi-tenant nature of the platform make this a high-priority issue.
Privilege elevation in Microsoft Azure SQL Managed Instance lets an unauthenticated network attacker cross the intended communication-channel boundary and gain elevated privileges, carrying a scope-changed CVSS of 10.0 that reflects likely cross-tenant or cross-service impact in this multi-tenant PaaS offering. Microsoft tags it as an authentication bypass exposing high-value confidentiality and integrity, with no availability loss. There is no public exploit identified at time of analysis and EPSS probability is low (0.36%, 29th percentile), consistent with a vendor-discovered, service-side issue rather than mass exploitation.
Missing authentication in the LightRAG API server (HKUDS/LightRAG) through version 1.5.4 exposes every management endpoint to unauthenticated network attackers, because the server binds to 0.0.0.0 by default while authentication is off unless explicitly configured. Any attacker with network reach can read indexed document content, upload or delete documents, rewrite the knowledge graph, cancel ingestion pipelines, clear caches, and consume LLM/API credits. No public exploit identified at time of analysis, but exploitation is trivial via a single unauthenticated HTTP request, and the fix in 1.5.5rc1 is largely a hardening/warning change rather than an enforced secure default, so operator action is still required.
PHP Object Injection in the Ajax Search Lite WordPress plugin before 4.14.5 lets unauthenticated remote attackers pass untrusted serialized data into a PHP unserialize() sink, and where a suitable POP gadget chain exists in a co-installed plugin or theme, this escalates to remote code execution. Reported by WPScan with publicly available exploit code, it carries a CVSS 9.8 rating but a low EPSS of 0.22% (13th percentile), and is not listed in CISA KEV. A vendor patch is available in version 4.14.5.
Payment bypass in the WP Events Manager WordPress plugin before 2.2.5 lets any authenticated user register for a paid event and receive a fully completed booking without paying, because the plugin trusts an attacker-controlled quantity value and derives the charge from it. WPScan reports publicly available exploit code exists, though there is no evidence of active exploitation and the EPSS score is very low (0.13%, 3rd percentile). The flaw is a business-logic/authorization defect rather than a memory-safety issue, so impact is financial fraud against event organizers rather than server compromise.
Server-side request forgery in Microsoft Office SharePoint lets a remote, unauthenticated attacker coerce the server into issuing attacker-controlled requests, enabling spoofing across a network per Microsoft's classification. The CVSS 3.1 base score is 9.6 (critical) with a changed scope, and exploitation requires a victim to interact with attacker-supplied content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege elevation in Microsoft Teams allows an authenticated attacker with low-level access to bypass authentication controls and gain higher privileges across a network boundary. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H) shows the flaw is remotely reachable, requires only low existing privileges, needs no user interaction, and crosses a security scope to compromise confidentiality and integrity of resources beyond the initially authorized context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.6 base score reflects the low barrier to abuse once an attacker holds any authenticated Teams foothold.
Authentication bypass in the MStore API WordPress plugin before 4.21.0 lets an unauthenticated remote attacker mark any order as fully paid without processing a real payment, because several payment-completion endpoints trust the client-supplied completion signal instead of verifying it against the payment gateway. Any store using this plugin can be defrauded of goods, services, or digital downloads. A public exploit exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Insufficient-entropy secret generation in the crypto-js npm library (all 3.x releases except 3.2.0/3.2.1, i.e. versions < 4.0.0) collapses CryptoJS.lib.WordArray.random() to effective search spaces of only ~2^39 (128-bit request) and ~2^47 (256-bit request), letting attackers brute-force any long-term secret produced by it. Downstream cryptocurrency wallets used this function as the entropy source for BIP39 recovery phrases; Coinspect's 'Ill Bloom' investigation reproduced full key recovery and documented coordinated drain waves that stole a lower-bound of ~$5M in assets as of 13 July 2026. This is not in CISA KEV, but a proof of concept exists and real-world theft has been documented by the researchers.
Reflected XSS on the WordPress login page allows remote unauthenticated attackers to inject and execute malicious scripts in a victim's browser via specially crafted URLs, with a conditional escalation path to remote code execution. All WordPress versions are affected; exploitation requires active social engineering and explicit victim interaction, and the RCE escalation pathway depends on conditions outside the attacker's direct control. No public exploit has been identified at time of analysis; WordPress 7.0.3 and backported branch releases resolve the vulnerability.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-level user to include and execute arbitrary existing PHP files on the server, resulting in full compromise of confidentiality, integrity, and availability. The root cause is a missing capability check on an AJAX action combined with unvalidated user-controlled path input - two compounding weaknesses that collectively drop the privilege bar to the lowest registered-user tier. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation activity at time of analysis despite the public POC.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.
Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated remote attacker to crash the Ruby process by supplying a crafted truncated JSON stream with duplicate object keys to any application using JSON::ResumableParser. The root cause is that the parser's input buffer is freed without resetting the state.start, state.cursor, and state.end pointers, which are subsequently dereferenced when partial_value processes the duplicate-key warning path via cursor_position, producing a heap-use-after-free confirmed by AddressSanitizer and a native SIGSEGV on official RubyGem releases. Impact is limited to availability - no code execution or information disclosure is claimed - and no public exploit code has been identified at time of analysis, though a private end-to-end TCP proof-of-concept was submitted with the advisory.
Incorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a format-scoped delegated repository-admin privilege to create repositories in unauthorized formats - bypassing the intended scope boundary. Affected are all releases from 3.0.0 through 3.94.x; version 3.95.0 resolves the flaw. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the integrity impact is high given that unauthorized repository types could be introduced into a managed artifact store, potentially tainting software supply chain pipelines.
SQL injection in the Content Views WordPress plugin before 4.5 exposes the underlying WordPress database to any authenticated user, including low-privilege Subscribers. Two compounding weaknesses drive this: a missing capability check on an AJAX action allows unprivileged users to reach a sensitive endpoint, and unsanitized attacker-controlled input is then passed directly into a raw SQL query. A publicly available POC exists via WPScan, and SSVC rates the technical impact as total, though EPSS remains low at 0.16%, suggesting no widespread automated exploitation at time of analysis.
Account takeover in MStore API WordPress plugin before 4.21.0 is achievable by unauthenticated remote attackers who know a target's registered phone number, by forging a cryptographically invalid login token that the plugin fails to properly verify. This yields full control over the targeted account, including administrator-level WordPress accounts. A publicly available proof-of-concept exists; however, no CISA KEV listing is present and EPSS at 0.14% (3rd percentile) indicates low observed exploitation to date, likely constrained by the phone-number reconnaissance prerequisite.
Hardcoded plaintext credentials embedded in ZTE device firmware expose the web management interface to unauthorized access. The initial login credentials for the device's web interface are stored unencrypted within the firmware image, allowing any party who obtains the firmware to authenticate to any affected device. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the trivial nature of credential extraction from downloadable firmware files significantly elevates practical risk beyond what EPSS alone may reflect.
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated identity impersonation over the network. The flaw, tagged as a JWT attack enabling authentication bypass, allows a remote attacker with no prior credentials to forge or tamper with token-based identity claims that Teams fails to properly verify. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a low-barrier, remotely exploitable path with high integrity impact.
Unauthenticated REST API bypass in the 'Password Protected - Lock Entire Site' WordPress plugin (versions 2.6.8 through 2.8.3) exposes all password-gated content and account identifiers to unauthenticated visitors when the plugin's REST API restriction option is enabled. This is a confirmed regression of CVE-2024-0437, which was originally patched in version 2.6.7 but silently reintroduced in the very next release (2.6.8), leaving sites unprotected for any version in that range. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (4th percentile), indicating limited observed exploitation at time of analysis.
Integrity bypass in MStore API WordPress plugin (versions before 4.21.0) enables unauthenticated remote attackers to create fraudulent WooCommerce product reviews with arbitrary reviewer names, email addresses, and star ratings, completely circumventing the store's verified-purchase-only review restriction. The plugin's REST API review creation route applies neither authorization nor purchase-ownership validation, rendering the WooCommerce protection setting ineffective when the plugin is active. A publicly available proof-of-concept exists and SSVC confirms the attack is automatable, though the EPSS exploitation probability sits at just 0.14% (3rd percentile), suggesting limited real-world exploitation activity despite ease of execution.
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
Symlink traversal in go-git's worktree filesystem layer allows a maliciously crafted repository to cause write operations to escape the intended worktree boundary when cloned and operated upon. Affected are all filesystem-backed go-git deployments using v5 prior to 5.19.2 and v6 prior to 6.0.0-alpha.5. An attacker who controls a repository can plant symlinks such that a victim's go-git worktree operations (checkout, add, status) silently overwrite files outside the working directory - including critical Git metadata like .git/config - enabling repository poisoning or arbitrary local file corruption. No public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).
Local privilege escalation in StableBit Scanner 2.6.13.4088 allows a low-privileged Windows user to exploit permission misconfigurations in Scanner.Service.exe - the Windows service component of the disk health monitoring tool - to achieve high confidentiality, integrity, and availability impact on the local system. The exploit reference titles the technique as 'local privilege escalation via insecure deserialization,' suggesting the ScannerService's IPC or communication surface deserializes attacker-controlled data without adequate permission enforcement. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists per VulDB and the referenced PoC page, though no CISA KEV listing confirms active in-production exploitation.
Improper access control in V-Secure Jingyun Antivirus 2.4.2.39 allows a local low-privileged user to interact with the ZyArk.sys kernel driver in ways that bypass intended access restrictions, yielding high-impact compromise of confidentiality, integrity, and availability on the affected host. A publicly available proof-of-concept exploit (E:P per the CVSS 4.0 vector) lowers the bar for exploitation, though the local-only attack vector limits the exposure to already-authenticated users or post-initial-access scenarios. The vendor was contacted prior to disclosure but did not respond, meaning no official patch exists at time of analysis.
Local privilege escalation in Jiangmin Antivirus 21 exploits improper access controls in the kernel-mode driver kvcore.sys, specifically within the MessageNotifyCallback function of the Minifilter Port component. A low-privileged local attacker can send crafted messages to this communication port to bypass access enforcement, achieving high impact across confidentiality, integrity, and availability on the affected system. No public exploit identified at time of analysis is incorrect here - a publicly available exploit exists on GitHub, and the vendor did not respond to responsible disclosure, leaving no patch available.
Local privilege escalation in PowerISO 9.3.0.0 on Windows exposes low-privileged local users to full system compromise via the scdemu.sys kernel driver's improper privilege management (CWE-269). The exploit - publicly detailed as arbitrary registry write or deletion through the driver's IOCTL interface - allows elevation to SYSTEM-level control with high confidentiality, integrity, and availability impact on the vulnerable host. No vendor patch exists; the vendor did not respond to responsible disclosure, and a public proof-of-concept has been released, lowering the skill threshold for exploitation.
DeepCool DisplayService 1.2.12 on Windows exposes an unauthenticated LocalSystem-level named pipe control channel that any low-privileged local user can connect to and manipulate, enabling full privilege escalation to SYSTEM. The root cause is CWE-284 (Improper Access Control) - the service's IPC channel enforces no caller authentication or ACL verification. A public proof-of-concept is available per VulDB and a researcher's writeup; the vulnerability is not currently listed in CISA KEV, indicating no confirmed mass exploitation, though the low attack complexity and available POC materially elevate near-term risk.
Local privilege escalation in StableBit DrivePool 2.3.13.1687 allows a low-privileged local user to achieve high-impact compromise of confidentiality, integrity, and availability on the affected system. The vulnerability resides in DrivePool.Service.exe and stems from CWE-275 permission issues, with the publicly available exploit reference explicitly identifying insecure deserialization as the attack mechanism enabling escalation. No active exploitation has been confirmed by CISA KEV, but a public proof-of-concept exists and the CVSS 4.0 vector includes E:P (exploit proof-of-concept), elevating real-world risk above theoretical.
Elevation of privilege in Microsoft Azure SQL Database lets an unauthorized network attacker bypass authentication and gain higher privileges, with a maximum CVSS 10.0 and a scope change indicating the flaw extends impact beyond the initially vulnerable component. The CVSS vector (PR:N/UI:N) means no credentials or user interaction are required, making this a critical priority despite no public exploit being identified. As a managed cloud service, remediation is handled server-side by Microsoft rather than by customer patching.
Privilege escalation in the Microsoft Entra Provisioning Service (SyncFabric) allows an already-authorized, low-privileged network attacker to elevate privileges via a path-traversal sequence ('.../...//'), with a scope change (S:C) that lets impact cross into other security domains such as the underlying identity/provisioning tenant. Rated CVSS 9.9, the flaw yields high confidentiality, integrity, and availability impact and requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority issue for the affected cloud service.
Privilege elevation in Microsoft Azure Active Directory (Entra ID) lets an already-authenticated, low-privileged attacker tamper with data the platform treats as immutable to gain higher-privileged access over a network. The CVSS 3.1 score of 9.9 reflects a scope change (S:C), meaning the compromise crosses the security boundary of the low-privilege account into the broader identity tenant. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV; note that despite Microsoft's 'Information Disclosure' tag, the CWE and CVSS impact metrics actually describe an elevation-of-privilege condition.
Privilege elevation in Microsoft's Azure SRE Agent lets an already-authorized, low-privilege network actor gain higher privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw means an attacker holding only limited access to the service can cross a trust boundary and reach resources or actions reserved for higher-privilege identities. No public exploit has been identified at time of analysis and it is not on the CISA KEV list, but the near-maximum score and cloud-service exposure make it a high-priority patch item.
Smarty PHP template engine versions 5.0.0 through 5.8.3 expose a security policy bypass allowing file disclosure via the built-in `stream:` resource type. When Smarty Security is enabled and `Security::$streams` is set to `null` or a restricted allowlist, an attacker able to author or influence a template resource reference can use `stream:php://filter/...` to read arbitrary local files accessible to the PHP process - bypassing the very control intended to block such access. A public proof-of-concept was disclosed in GHSA-rjhh-76wf-8xmw; no active exploitation is confirmed in CISA KEV. The issue is fixed in v5.8.4.
Privilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions by exploiting improper verification of a cryptographic signature (CWE-347), consistent with the vendor-supplied 'Authentication Bypass' and 'JWT Attack' tags. The maximal 9.8 CVSS with a fully network-reachable, no-privilege, no-interaction vector makes this a critical bypass of the admin portal's trust boundary. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Information disclosure in Microsoft Azure Logic Apps allows an authenticated, low-privileged attacker to read data they should not have access to across a network, with a scope-changed CVSS 3.1 score of 9.6 reflecting potential cross-boundary (multi-tenant) impact. The flaw stems from improper access control (CWE-284) in the cloud workflow-automation service; Microsoft is the reporter and remediation is delivered service-side. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though the high score and scope change warrant prompt attention.
Netty's RedisArrayAggregator codec fails to release retained partial aggregate state when the maxElements limit is exceeded, unlike the symmetric maxNestedArrayDepth branch which correctly calls releaseAndClearDepths() before throwing. In applications that keep the channel alive after a codec exception - a common resilience pattern - an unauthenticated peer can exploit this inconsistency to keep attacker-controlled ByteBuf references pinned in Netty's pooled buffer allocator and cause subsequent messages to be consumed into the stale pre-error aggregate. A public proof-of-concept test is included in the GHSA advisory; fixed in Netty 4.1.136.Final and 4.2.16.Final with no KEV listing at time of analysis.
Hardcoded cryptographic credentials embedded in unencrypted ZTE ZXHN F680 router firmware allow a low-privilege authenticated network attacker to extract integrity verification keys and subsequently bypass application integrity checks on the device. Seven specific firmware versions across the V9.0.10 P1, P4, and P6 branches are confirmed affected per the ZTE advisory. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Denial of Service in the WP Maps WordPress plugin before 4.9.7 allows any authenticated subscriber to exhaust server resources by exploiting a missing capability check in an AJAX action handler. The flaw, discovered and reported by WPScan, permits a low-privileged user to invoke an unrestricted operation that triggers uncontrolled recursion, potentially rendering the affected WordPress site unavailable. A publicly available proof-of-concept exists, though EPSS remains low (0.14%) and CISA has not listed this in KEV, suggesting exploitation is currently opportunistic rather than widespread.
Unauthenticated cloud credential hijacking in the Templately WordPress plugin (all versions before 3.7.1) allows any remote attacker to overwrite the site administrator's stored cloud service connection with an account under their control. This severs the legitimate administrator's access to the cloud template library and redirects the site's template source to attacker-controlled infrastructure, enabling supply-chain-style content injection against the WordPress admin. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.14%, 3rd percentile), and no CISA KEV listing confirms active widespread exploitation at time of analysis.
Broken Object Level Authorization in MStore API WordPress plugin (all versions before 4.21.0) exposes every WooCommerce order and associated customer PII to any authenticated WordPress user, including low-privileged Subscribers. The vendor-orders endpoint performs no caller-scoping check, meaning a Subscriber can enumerate the entire store's order history. Publicly available exploit code exists per WPScan, though EPSS at 0.13% (3rd percentile) indicates exploitation has not become widespread at time of analysis; no CISA KEV listing confirms active exploitation.
Privilege elevation in Microsoft Power Apps allows an unauthorized, network-based attacker to gain elevated permissions by abusing improper authorization checks, with a scope change (S:C) indicating the impact crosses a security boundary beyond the initially compromised component. Exploitation requires some user interaction (UI:R) but no prior authentication (PR:N), and results in high confidentiality and integrity impact. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (Critical).
Path traversal in go-git's filesystem-backed reference storage allows a malicious Git server to overwrite arbitrary files within the `.git` directory - including sensitive metadata like `.git/config` and `.git/HEAD` - by advertising crafted reference names containing `..` sequences. Any application using go-git with the `storage/filesystem` package that clones from or fetches untrusted remote repositories is affected; versions prior to 5.19.2 (v5 branch) and 6.0.0-alpha.5 (v6 branch) are vulnerable. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is straightforward and requires only that an attacker control a Git server the victim application connects to.
Remote code execution in Azure Confidential Ledger allows an authorized attacker with elevated privileges to invoke an exposed dangerous method over the network and run arbitrary code, with a scope change (S:C) that lets the impact reach beyond the initially compromised component. Microsoft rates it CVSS 9.1 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Azure Confidential Ledger is a managed cloud service, remediation is delivered server-side by Microsoft rather than by customer patching.
Stored Cross-Site Scripting in the Comments WordPress plugin (all versions before 7.6.60) permits unauthenticated attackers to permanently inject malicious JavaScript into the site database by submitting a crafted URL that the plugin fails to escape before rendering inside an HTML attribute. Any authenticated user - including site administrators - who subsequently views the affected content triggers payload execution in their browser, potentially enabling session hijacking and full site takeover. A publicly available exploit is referenced via WPScan, though EPSS at 0.17% (7th percentile) indicates low observed exploitation volume at time of analysis, and the vulnerability is not listed in CISA KEV.
Reflected XSS in the Subscribe2 WordPress plugin (versions before 10.46) allows an unauthenticated attacker to inject arbitrary JavaScript into a public subscription form by luring a visitor to a crafted link. Exploitation requires the victim to interact with the malicious URL - no server-side authentication is needed - enabling session theft, credential harvesting, or DOM-based actions scoped to the victim's browser. A publicly available proof-of-concept exists per WPScan; EPSS at 0.16% (5th percentile) indicates limited automated exploitation despite the low attack complexity.
Privilege elevation in Microsoft Planetary Computer Pro allows a remote, unauthenticated attacker to gain elevated privileges over the network by invoking a critical function that lacks an authentication check (CWE-306). Scored CVSS 10.0 with a scope change, the flaw exposes confidential data and permits unauthorized modification against the affected Azure geospatial platform. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the maximal score reflects trivial exploitability against exposed instances.
Privilege escalation in the XML-RPC API of Plesk before 18.0.80 allows an authenticated reseller-level account to obtain a fully administrative session for the root user, effectively taking over the entire hosting server. The flaw is a CWE-269 improper privilege management issue reported through HackerOne; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Because a reseller can cross the privilege boundary to root with low attack complexity, this is a high-impact server-takeover vector in multi-tenant hosting environments.
Path traversal in Microsoft Application Insights Profiler allows an authenticated low-privilege network attacker to escalate privileges, with high confidentiality, integrity, and availability impact. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) indicates exploitation requires no special conditions beyond a valid low-privilege account and network reachability, making the barrier to exploitation low. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and high impact profile warrant prompt remediation.
Payment integrity bypass in the Subscriptions for WooCommerce plugin (versions before 2.0.1) enables financial fraud by allowing substitution of an arbitrary approved PayPal order token during the WooCommerce order-received flow. The plugin captures a client-supplied token and marks any order paid solely based on a COMPLETED capture status, without verifying that the captured amount matches the order total or that the token belongs to the specific order. Unauthenticated attackers - where guest checkout is enabled - can exploit this to obtain goods or subscription access without paying the actual order price. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.