What is the CVSS score of CVE-2026-15230?

CVE-2026-15230 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of YayPricing are affected by CVE-2026-15230?

WooCommerce stores using the YayPricing plugin (versions before 3.5.7) face pricing manipulation and coupon code theft risk from any authenticated subscriber.. A patch is available.

Is there a public PoC exploit available for CVE-2026-15230?

Yes, a public proof-of-concept exploit is available for CVE-2026-15230. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-15230?

Within 24 hours, inventory all WooCommerce installations to identify those running YayPricing and document current versions. Within 7 days, upgrade all affected stores running YayPricing versions prior to 3.5.7 to version 3.5.7 or later. Within 30 days, review subscriber account activity logs for unauthorized pricing changes or coupon code access, and implement role-based controls restricting pricing modifications to administrator accounts only.

YayPricing CVE-2026-15230

EUVD-2026-53116 HIGH

Improper Access Control (CWE-284)

2026-08-05 WPScan

GHSA-rhmm-6m6v-j5v4

WordPress Authentication Bypass Yaypricing Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

REST API is network-accessible with no complexity barrier; subscriber-level account (PR:L) is sufficient; high confidentiality and integrity impact from coupon disclosure and pricing manipulation; no availability impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:46 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 8.1

DescriptionCVE.org

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes.

AnalysisAI

Missing capability checks across multiple REST API routes in the YayPricing WordPress plugin (all versions before 3.5.7) allow any subscriber-level authenticated user to overwrite a WooCommerce store's complete pricing configuration and extract private coupon codes. The plugin incorrectly relies on a shared nonce as its sole authorization gate rather than WordPress capability checks, a fundamental access control failure classified under CWE-284. A publicly available exploit exists per WPScan (EUVD-2026-53116), though EPSS sits at 0.14% (4th percentile), indicating low automated exploitation activity; CISA KEV listing is absent, so active exploitation in the wild is not confirmed.

Technical ContextAI

YayPricing is a WooCommerce-adjacent WordPress plugin that manages dynamic store pricing rules and coupon logic via REST API endpoints. WordPress nonces are session tokens used for CSRF protection but are not role-scoped - any authenticated user can obtain a valid nonce. The plugin's REST API routes fail to call WordPress capability functions such as current_user_can() before processing writes to pricing configuration or reads of coupon data. This is a textbook CWE-284 (Improper Access Control) pattern: authentication is present (nonce validates the session exists) but authorization is absent (no check that the session holder holds a sufficient role). The affected CPE is cpe:2.3:a:unknown:yaypricing:*:*:*:*:*:*:*:* covering all versions 0 through 3.5.6 inclusive. The vendor field in NVD CPE is currently listed as 'unknown', indicating attribution has not yet been resolved in the NVD dataset.

RemediationAI

Update YayPricing to version 3.5.7 or later immediately; this is the vendor-released patch confirmed by WPScan at https://wpscan.com/vulnerability/c2346f90-130c-45da-92ca-31acaa2f4605/. WordPress site administrators can update the plugin directly from the WordPress admin dashboard under Plugins > Updates. If an immediate update is not possible, consider disabling user registration on the WordPress site to prevent attackers from self-registering subscriber accounts, though this will block legitimate customer sign-ups and may impact WooCommerce checkout flows. Alternatively, a Web Application Firewall rule blocking REST API requests to YayPricing-specific route namespaces from non-admin users can serve as a temporary compensating control, but this requires knowledge of the specific route paths and may break intended plugin functionality. Audit existing subscriber and customer accounts for unauthorized pricing or coupon changes as part of incident response.