What is the CVSS score of CVE-2026-39448?

CVE-2026-39448 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of NOWPayments for WooCommerce are affected by CVE-2026-39448?

The NOWPayments for WooCommerce plugin (versions 1.4.0 or earlier) exposes merchants to unauthenticated access control vulnerabilities that allow attackers to modify payment orders without…

How to fix or mitigate CVE-2026-39448?

24 hours: Identify all systems running NOWPayments versions 1.4.0 or earlier; disable the plugin immediately; audit all orders created or modified since plugin deployment for unauthorized changes. 7 days: Implement WAF rules restricting access to payment order modification endpoints; enable detailed logging for all order state changes; request patch timeline and interim guidance from NOWPayments vendor. 30 days: Deploy patched version when released by NOWPayments; conduct comprehensive audit of all order modifications that occurred during the vulnerable exposure period; establish continuous monitoring for unauthorized order changes.

NOWPayments for WooCommerce CVE-2026-39448

EUVD-2026-41339 HIGH

Missing Authorization (CWE-862)

2026-07-02 Patchstack

GHSA-84q6-57x9-mmj9

WordPress Authentication Bypass Wordpress Plugin Nowpayments For Woocommerce Coderpress

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint with no authorization check (PR:N, AV:N, AC:L, UI:N); impact is state tampering only, so I:H with C:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:11 vuln.today

CVE Published

Jul 02, 2026 - 11:15 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

AnalysisAI

Broken access control in the NOWPayments for WooCommerce WordPress plugin (versions <= 1.4.0) allows unauthenticated remote attackers to perform actions or modify state that should be restricted, without any authentication. The flaw stems from a missing authorization check (CWE-862) on a network-reachable endpoint, and per its CVSS 3.1 vector it affects integrity only (I:H) with no confidentiality or availability impact. No public exploit has been identified at time of analysis, though the vulnerability was cataloged by Patchstack, a specialist in WordPress plugin security research.

Technical ContextAI

The affected component is the NOWPayments for WooCommerce plugin (CPE cpe:2.3:a:coderpress:nowpayments_for_woocommerce), a payment-gateway integration that connects WooCommerce stores to the NOWPayments cryptocurrency processor. The root cause is CWE-862 (Missing Authorization): a handler - typically a WordPress AJAX action, REST route, or webhook/IPN callback - is exposed without verifying the caller's identity or capability. In WordPress plugins this class of bug usually arises from registering a wp_ajax_nopriv_ action, an unauthenticated REST endpoint, or a payment-callback handler that lacks a nonce, capability check, or signature validation, allowing untrusted callers to invoke privileged logic.

RemediationAI

Upgrade the NOWPayments for WooCommerce plugin to a version later than 1.4.0 once the vendor publishes a fixed release; the input identifies the last vulnerable version as 1.4.0 but does not state an exact patched version, so no vendor-released patch version is independently confirmed at time of analysis - verify the fixed release via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/nowpayments-for-woocommerce/vulnerability/wordpress-nowpayments-for-woocommerce-plugin-1-4-0-broken-access-control-vulnerability) or the WordPress.org plugin changelog. Until a patch is applied, compensating controls include deploying a WordPress WAF (Patchstack or equivalent) with a virtual patch for this CVE, restricting access to the plugin's callback/AJAX endpoints at the web-server or firewall layer, and - if the crypto payment method is non-essential - temporarily deactivating the plugin, with the trade-off that cryptocurrency checkout will be unavailable to customers.