Woopayments CVE-2026-1710

The CVSS 6.5 score reflects the network-based attack vector (AV:N) with no special complexity (AC:L) or privileges required (PR:N), but limited scope of impact (integrity and availability degradation only, no confidentiality breach). The missing capability check represents a clear authorization flaw rather than a complex vulnerability chain. Given that this is a remote unauthenticated attack on a publicly accessible WordPress plugin endpoint, the practical exploitability is high. However, the integrity impact is limited to plugin configuration rather than data theft or code execution, and availability impact is partial rather than complete service loss. Real-world risk depends on how much damage misconfigured payment appearance settings can cause to business operations; for some merchants this could be critical (if it prevents legitimate checkouts), while for others it may be cosmetic. The absence of a public proof-of-concept or KEV status suggests this is not yet widely weaponized, but the simplicity of the vulnerability (unauthenticated remote request to a known AJAX endpoint) means exploitation requires minimal technical skill once the flaw is understood.

An attacker identifies the WooPayments plugin is active on a WordPress site and targets the vulnerable 'save_upe_appearance_ajax' AJAX endpoint with a forged HTTP request containing modified payment appearance settings. Since the endpoint lacks capability verification, the request is processed without authentication, allowing the attacker to change payment gateway appearance configurations such as colors, logos, or field labels. Depending on the attacker's intent, this could be used to mislead customers during checkout (phishing-adjacent attacks) or to deface the payment interface, degrading customer trust. No public proof-of-concept code has been identified, but exploitation requires only knowledge of the vulnerable endpoint and basic HTTP request crafting-well within the capabilities of opportunistic attackers scanning WordPress installations.