Swish for WooCommerce CVE-2026-111835

Requires the target WordPress site to have the BjornTech Swish for WooCommerce plugin (woo-swish-e-commerce) installed and active at a version up to and including 3.7.8. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special privileges, and no user interaction are required - exploitation works remotely against the affected plugin's default state by reaching an endpoint that performs no authorization check. The main limiting factor is footprint: this is a region-specific Swish (Swedish mobile payment) integration for WooCommerce, so only WooCommerce stores that have installed this particular plugin and not yet updated past 3.7.8 are exposed; impact is bounded to the Low-confidentiality/Low-integrity functionality the missing check protects, not full site takeover.

This is a medium-severity (CVSS 6.5) Missing Authorization / Broken Access Control flaw (CWE-862) in the BjornTech Swish for WooCommerce WordPress plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, with only Low confidentiality and Low integrity impact and no availability impact - consistent with an access-control gap that exposes or lets attackers manipulate a limited subset of plugin functionality or data rather than enabling full compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization; the signals are therefore not conflicting but simply thin - severity rests entirely on the vendor-assigned CVSS. The partial C/I impact (not High) tempers real-world urgency: this is a legitimate patch-worthy issue but not a drop-everything priority absent exploitation evidence, and its practical impact depends heavily on how niche the affected plugin is. Note the input tag labels this an 'Authentication Bypass' while the CWE-862 classification and description describe Missing Authorization (authorization, not authentication) - verify the precise mechanism with the Patchstack advisory.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running a vulnerable version (up to 3.7.8) of the Swish for WooCommerce plugin, invoking a plugin action or endpoint that fails to verify the caller's authorization. This lets the attacker read or alter limited payment-plugin data or trigger functionality intended for privileged users. No public exploit code is identified at time of analysis, so exploitation would require an attacker to independently derive the vulnerable endpoint.