Bayarcash WooCommerce CVE-2026-106609

Requires a WordPress site running the Bayarcash WooCommerce plugin (web_impian bayarcash_woocommerce) at any version up to and including 4.4.2, with the vulnerable plugin endpoint network-reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special complexity are needed, so default installations of the affected versions are exposed to remote unauthenticated requests. The practical limiting factor is deployment scope rather than configuration: the plugin must be installed and active, and because Bayarcash is a Malaysia-specific payment gateway, the realistic exposure is confined to merchants using that gateway. Impact is limited to integrity (C:N/A:N), so the condition does not yield data disclosure or denial of service.

This is a Missing Authorization (CWE-862) flaw in the Bayarcash WooCommerce plugin, rated CVSS 7.5 via vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - network-exploitable, low complexity, no privileges, no user interaction, with a pure integrity impact (C:N/I:H/A:N). On paper this is attractive to attackers (remote, unauthenticated, trivial), but the integrity-only impact means it enables unauthorized state changes rather than data theft or outage. Exploitation signals are weak-to-absent: no CISA KEV listing, no public POC referenced, and no EPSS score was supplied, so there is no evidence of active or at-scale exploitation at time of analysis - the only source is a single Patchstack advisory. Net assessment: a genuinely exploitable broken-access-control bug worth patching promptly for affected WooCommerce stores, but the real-world urgency is tempered by the plugin's narrow deployment footprint (a Malaysia-focused payment gateway) and the lack of any exploitation telemetry. EPSS, KEV, and POC data are all missing/negative, so widespread opportunistic attack is unlikely - prioritize based on whether you actually run this plugin, not on the 7.5 score alone.

A remote, unauthenticated attacker sends a crafted HTTP request directly to an access-control-deficient endpoint or action exposed by the Bayarcash WooCommerce plugin (<= 4.4.2) on a WordPress store. Because the plugin fails to verify the caller's authorization (CWE-862), the attacker performs a privileged action - such as manipulating payment/order state or configuration - without any credentials. No public exploit code is identified at time of analysis, and the low-complexity network vector (AV:N/AC:L) means no special timing or conditions are needed once the vulnerable endpoint is reachable.