YITH PayPal Express CVE-2026-111409

Requires the YITH PayPal Express Checkout for WooCommerce plugin to be installed and active at version 1.61.0 or earlier on a WordPress/WooCommerce site, with the vulnerable (unauthenticated-reachable) plugin endpoint exposed. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, user interaction, or special non-default configuration is indicated as required - exploitation targets the plugin's default access-control handling. Limiting factors: the attacker must identify the specific unprotected plugin action, and the impact is bounded to low-level confidentiality disclosure (no write/integrity or availability effect), so successful exploitation yields limited data exposure rather than site control. The description does not specify the exact feature or data involved, so the precise exposed resource should be verified against the Patchstack advisory.

This is a moderate-severity Missing Authorization flaw (CWE-862) with a CVSS 3.1 base score of 5.3 driven entirely by a low-confidentiality impact (C:L/I:N/A:N) - meaning the realistic outcome is limited unauthorized information disclosure, not account takeover, data tampering, or site compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the flaw is remotely reachable, low-complexity, and requires no authentication or user interaction, which raises its opportunistic exploitability. However, several escalating signals are ABSENT: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - only a single Patchstack advisory. There is no SSVC decision data in the input. The combination of 'easy to reach but low impact' plus 'no evidence of exploitation or exploit code' places this as a routine patch-management item rather than an emergency: a genuine but low-urgency issue typical of WordPress plugin broken-access-control reports. Note that the CVSS vector and the CWE agree (both point to unauthenticated access-control failure), so no metric conflict exists, but the description is generic and does not name the specific exposed endpoint or data, which limits precision of the risk estimate.

A remote, unauthenticated attacker sends a crafted HTTP request directly to a plugin endpoint or AJAX/REST action that fails to verify the caller's authorization, retrieving or triggering functionality that should be restricted. Because the impact is confidentiality-only and low, the practical result is exposure of limited data (such as order, checkout, or configuration details) rather than full compromise. No public exploit code is referenced, so exploitation would require an attacker to independently identify the specific unprotected endpoint.