What is the CVSS score of CVE-2026-57408?

CVE-2026-57408 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Peach Payments Gateway CVE-2026-57408

EUVD-2026-43480 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Peach Payments Gateway

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Plugin endpoint is network-accessible with no auth check (PR:N); scope unchanged, impact capped at Low integrity and availability with no confidentiality loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:25 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 4.0.2.

AnalysisAI

Broken access control in the Peach Payments Gateway WordPress plugin (all versions through 4.0.2) permits remote unauthenticated attackers to invoke plugin functionality without valid authorization, bypassing intended access control security levels. Rooted in CWE-862 (Missing Authorization) and reported by Patchstack, the flaw enables limited integrity and availability impact against WooCommerce-powered sites using this plugin. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the unauthenticated, low-complexity attack vector warrants prompt remediation for any site processing payments through this gateway.

Technical ContextAI

The affected product is a WooCommerce payment gateway plugin for WordPress, identified by CPE cpe:2.3:a:peachpayments:peach_payments_gateway:*:*:*:*:*:*:*:* covering all versions through 4.0.2. CWE-862 (Missing Authorization) describes a failure to perform or properly enforce authorization checks before granting access to a resource or functionality. In the WordPress/WooCommerce plugin ecosystem this typically manifests as AJAX handlers, REST API endpoints, or admin callbacks that omit WordPress capability checks (current_user_can()) or nonce validation, leaving them reachable by unauthenticated or low-privilege HTTP requests. Given the 'Authentication Bypass' tag assigned by Patchstack, the missing check is accessible without any session, allowing direct invocation of privileged plugin actions from the network.

RemediationAI

Update the Peach Payments Gateway plugin to the version identified as patched in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wc-peach-payments-gateway/vulnerability/wordpress-peach-payments-gateway-plugin-4-0-2-broken-access-control-vulnerability - no exact fix version number is confirmed in the available data and one should not be assumed. Updates can be applied through the WordPress admin dashboard under Plugins > Installed Plugins. If an immediate update is not possible, a compensating control is to temporarily deactivate the Peach Payments Gateway plugin and route transactions through an alternative payment method, eliminating the attack surface entirely at the cost of payment functionality. A Web Application Firewall (WAF) rule blocking unauthenticated POST requests to the plugin's AJAX or REST endpoints may reduce exposure but cannot be considered a reliable substitute for patching given that the specific vulnerable endpoint is not publicly disclosed.