EUVD-2026-98352
GHSA-7h2h-j55f-6vmr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over network
-
ExploitSend crafted request to unprotected plugin action
-
ExecutionBypass missing authorization check
-
ImpactModify plugin-controlled data (integrity impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The plugin exposes functionality without a proper authorization (capability/permission) check, allowing a request to reach a protected action without the required privilege level; per CVSS PR:N/UI:N this needs no authentication and no user interaction against the affected plugin. The description does not name a specific feature, setting, or non-default mode as a precondition, so the concrete triggering endpoint is not specified in available data and should be confirmed against the Patchstack advisory. Limiting factors: impact is confined to a LOW integrity effect (no data disclosure or denial of service), the target WordPress site must have this specific plugin installed and active at version 3.0.1 or earlier, and the vulnerable action must be network-reachable. |
| Impact | This is a Missing Authorization flaw (CWE-862) in the Pay for Payment for WooCommerce WordPress plugin, rated CVSS 5.3 (Medium). The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, but impact is limited to a LOW integrity effect only - no confidentiality or availability loss. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no signal of active or probable exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (broken access control naturally maps to PR:N with limited integrity impact), so there is no network-vs-local conflict here. Overall this reads as a genuine-but-low-priority issue: easy to trigger in principle, but the constrained integrity-only impact and absence of any exploitation evidence place it well below critical broken-access-control bugs. Absence of EPSS/KEV/POC is a data gap, not proof of safety - but nothing in the data elevates this to an urgent priority. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request directly to an access-control-deficient endpoint or action exposed by the plugin, invoking functionality that should be restricted. Because authorization checks are missing, the attacker modifies or manipulates plugin-controlled data (consistent with the limited integrity-only impact), for example altering payment-surcharge settings or related state. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Missing authorization in the Pay for Payment for WooCommerce WordPress plugin (all versions through 3.0.1) allows unauthenticated remote attackers to reach functionality that should require an elevated capability, with impact limited to a low-integrity effect. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 Medium), no authentication or user interaction is required, but no data disclosure or denial of service results; the site must have the plugin installed and active at version 3.0.1 or earlier and the vulnerable action must be network-reachable. No confirmed active exploitation and no public exploit code were identified at time of analysis.
RemediationAI
Patch status for CVE-2026-108493 is not confirmed in the available data, so the first step is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woocommerce-pay-for-payment/vulnerability/wordpress-pay-for-payment-for-woocommerce-plugin-3-0-1-broken-access-control-vulnerability?_s_id=cve) and the plugin's WordPress.org page for a release later than 3.0.1 and upgrade immediately; do not assume 3.0.2 exists, as no fixed version is stated in the provided sources. If no patched release is available, deactivate and remove the plugin - the cleanest compensating control, at the cost of losing its payment-fee functionality on the storefront. As interim measures, restrict access to the plugin's endpoints: block or rate-limit the relevant admin-ajax/REST routes (for example via a WAF rule matching the plugin's action names or its /wp-content/plugins/woocommerce-pay-for-payment/ path) and, where the site architecture allows, require authenticated sessions for those routes; note these rules need tuning and can break legitimate checkout flows if the endpoint is customer-facing. Joomla-style hardening such as disabling plugin-related public endpoints should be validated against storefront functionality before deployment, and because exploitation requires no authentication, log review for unauthenticated requests to the plugin's actions is advisable to detect prior abuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a third-party WordPress plugin, 'Pay for Payment for WooCommerce' by Karolína Vyskočilová, tracked by the CPE cpe:2.3:a:karolína_vyskočilová:pay_for_payment_for_woocommerce:*:*:*:*:*:*:*:* for versions up to and including 3.0.1. The root cause is CWE-862 (Missing Authorization): a plugin-exposed action or endpoint - typically an admin-ajax, REST, or form-handler entry point in WordPress - is registered without a current_user_can() capability check (and, in many cases, without a nonce/token validation), so the request is processed regardless of the caller's privilege level. Because the CVSS vector carries PR:N and UI:N, the missing control is exploitable by an unauthenticated network caller without victim interaction; the specific endpoint, setting, or configuration precondition is not named in the available description or Patchstack reference, and the advisory at patchstack.com should be consulted to identify the exact vulnerable function. The resulting impact class is Incorrectly Configured Access Control Security Levels, expressed here as a LOW integrity effect only.
Know when Pay For Payment For Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Missing authorization is remotely reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); unauthorized state change gives limited integrity impact only, so C:N/I:L/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB