Autopay dla WooCommerce CVE-2026-57425

No authentication is required - the CVSS vector PR:N/AV:N/AC:L/UI:N confirms remote unauthenticated exploitation against any WordPress site where the Autopay dla WooCommerce plugin (version <= 2.2.27) is installed and active. WooCommerce must also be active as a dependency. The limiting factors are: the plugin must be installed and enabled (not merely present), the site must be publicly reachable over the network, and the exploitable endpoint must not be independently protected by server-level access controls or a WAF. The vulnerability does not require any specific WooCommerce store configuration beyond having the plugin active. There is no requirement for a logged-in victim user or any UI interaction.

The CVSS 6.5 Medium score is driven by the high accessibility of exploitation (AV:N/AC:L/PR:N/UI:N) tempered by limited per-exploitation impact (C:N/I:L/A:L/S:U). No EPSS score was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active mass exploitation. No POC code is referenced in the available data. The Patchstack disclosure is the sole intelligence source. The realistic risk profile is moderate for affected deployments: the attack surface is wide (any site with the plugin active), but the blast radius per exploitation is constrained - attackers cannot read payment credentials or customer data (C:N), only perform limited integrity or availability disruption at the plugin level. The primary concern for merchants is potential unauthorized order-state manipulation or disruption of the payment flow. Risk is further bounded by the plugin's limited deployment footprint outside of the Polish e-commerce ecosystem.

An unauthenticated attacker enumerates or identifies the Autopay dla WooCommerce plugin's unprotected AJAX or REST endpoint on a target WooCommerce store, then sends a crafted HTTP request directly to that endpoint without any session cookie or nonce. Because the plugin omits an authorization check, the request is processed and the attacker can trigger a restricted plugin action - such as altering order status or interfering with payment confirmation callbacks - without holding a WordPress account. No public POC has been identified at time of analysis, but the low complexity of the attack vector means this class of vulnerability is readily reproducible from plugin source code alone.