What is the CVSS score of CVE-2026-1710?

CVE-2026-1710 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Woocommerce CVE-2026-1710

EUVD-2026-17315 MEDIUM

Improper Authorization (CWE-285)

2026-03-31 Wordfence

GHSA-gvmc-87qh-q5mc

WordPress Authentication Bypass Woocommerce Woopayments Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 05:15 euvd

EUVD-2026-17315

Analysis Generated

Mar 31, 2026 - 05:15 vuln.today

CVE Published

Mar 31, 2026 - 04:25 nvd

MEDIUM 6.5

DescriptionCVE.org

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_upe_appearance_ajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to update plugin settings.

AnalysisAI

Unauthenticated attackers can modify WooPayments plugin settings through a missing capability check in the 'save_upe_appearance_ajax' AJAX function, affecting all versions up to and including 10.5.1. This allows remote attackers to alter payment appearance configurations without authentication, potentially disrupting payment processing or customer experience. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the WooPayments: Integrated WooCommerce Payments plugin for WordPress, specifically in the 'save_upe_appearance_ajax' AJAX handler within the WC_Payment_Gateway_WCPAY class. The vulnerability is classified as CWE-285 (Improper Authorization), indicating a failure to implement proper capability checks before processing user input via AJAX. WordPress AJAX endpoints require explicit capability verification using functions like current_user_can() to restrict access to authenticated, authorized users. In this case, the handler accepts and processes data that modifies plugin settings without validating the caller's permissions, allowing any network-based attacker to craft HTTP requests to the vulnerable endpoint and trigger the underlying modification logic.

RemediationAI

WooCommerce users should upgrade the WooPayments plugin to version 10.5.2 or later, which includes the necessary capability checks to remediate this vulnerability. Users can update via the WordPress admin dashboard (Plugins > Installed Plugins > WooPayments > Update) or by downloading the patched version directly from the official WordPress plugin repository. As a temporary workaround pending update, site administrators may restrict AJAX access via web application firewall (WAF) rules or .htaccess to block requests to the save_upe_appearance_ajax handler, though this is not a permanent solution. Additional hardening can be achieved by implementing WordPress security best practices such as limiting AJAX endpoint access by IP address if operationally feasible. Refer to the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/cec13225-baa3-4f26-b2d2-af6106888c74?source=cve) and WooCommerce plugin repository (https://plugins.trac.wordpress.org/changeset/3480315/woocommerce-payments/trunk/includes/class-wc-payment-gateway-wcpay.php) for confirmation of the patch.