What is the CVSS score of CVE-2026-59554?

CVE-2026-59554 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Ziina are affected by CVE-2026-59554?

The Ziina WordPress payment plugin (versions 1.2.21 and earlier) contains an authentication bypass vulnerability enabling unauthenticated attackers to access and manipulate payment functions without…

How to fix or mitigate CVE-2026-59554?

Within 24 hours, inventory all WordPress installations running Ziina plugin versions 1.2.21 or earlier and assess the scope of customer-facing payment exposure. Within 7 days, implement Web Application Firewall rules to restrict unauthenticated access to payment endpoints, disable the vulnerable plugin if operationally feasible, or isolate affected systems to trusted networks only. Within 30 days, establish monitoring of Patchstack and Ziina vendor advisories for patch releases, and develop a validated upgrade plan to deploy patched versions immediately upon availability.

Ziina CVE-2026-59554

EUVD-2026-48200 HIGH

Weak Authentication (CWE-1390)

2026-07-23 Patchstack

GHSA-7943-5x6v-f7g8

WordPress Information Disclosure Wordpress Plugin Ziina

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint with low complexity (AV:N/AC:L/PR:N/UI:N); broken auth enables unauthorized state change so I:H, with no confirmed confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:43 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.

AnalysisAI

Broken authentication in the Ziina WordPress payment plugin (versions <= 1.2.21) lets remote unauthenticated attackers bypass authentication controls, with the CVSS integrity-high rating indicating attackers can manipulate protected state or actions they should not be able to reach. Reported by Patchstack and classified under CWE-1390 (Weak Authentication), the issue is network-reachable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Ziina is a WordPress plugin (CPE cpe:2.3:a:ziina:ziina:*) that integrates the Ziina payment service into WordPress sites, typically for checkout or donation flows. The root cause is CWE-1390 (Weak Authentication), a class of flaw where the mechanism enforcing identity is missing, improperly implemented, or trivially bypassed - here allowing an unauthenticated party to reach functionality that should require a validated session. In WordPress plugins this pattern commonly arises from AJAX or REST endpoints registered without a proper capability/nonce check, or from trusting client-supplied identifiers instead of a verified server-side session.

RemediationAI

No vendor-released patch version was identified at time of analysis in the provided data; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ziina/vulnerability/wordpress-ziina-plugin-1-2-21-broken-authentication-vulnerability?_s_id=cve) for the fixed release and upgrade beyond 1.2.21 as soon as one is confirmed. Until a verified patched version is applied, compensating controls include deactivating and removing the Ziina plugin if the payment integration is non-essential (trade-off: disables Ziina checkout/payment functionality), and placing a WAF or virtual patch (Patchstack offers this) in front of the plugin's exposed AJAX/REST endpoints to block unauthenticated requests (trade-off: rules may need tuning to avoid breaking legitimate payment callbacks). Additionally, restrict access to WordPress admin and plugin endpoints by IP where feasible and monitor logs for anomalous requests to Ziina endpoints.