What is the CVSS score of CVE-2026-65457?

CVE-2026-65457 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

YooKassa for WooCommerce CVE-2026-65457

EUVD-2026-48222 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-qrpg-jwq8-56g9

WordPress Authentication Bypass Wordpress Plugin Kassa Woocommerce

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requires only a subscriber account (PR:L); no confidentiality or availability impact, only limited integrity modification.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:28 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

AnalysisAI

Broken access control in YooKassa для WooCommerce plugin (versions up to and including 2.16.1) permits authenticated WordPress subscribers to perform privileged actions beyond their intended role boundary. The CVSS vector (PR:L, AV:N, I:L) confirms that any low-privileged authenticated user - specifically a WordPress subscriber, the lowest default role - can exploit missing authorization checks over the network without additional interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack, which specializes in WordPress vulnerability disclosure, reported this finding.

Technical ContextAI

The vulnerability is rooted in CWE-862 (Missing Authorization), a class of flaw in WordPress plugins where registered AJAX actions, REST API endpoints, or admin-post hooks fail to validate that the calling user possesses the required capability before executing privileged logic. The affected product is a WooCommerce payment gateway plugin for YooKassa (formerly Yandex.Money / YooMoney), published by YooMoney and identified by CPE cpe:2.3:a:yoomoney:юkassa_для_woocommerce. WordPress subscriber accounts have only the 'read' capability by default, making any endpoint accessible to them that is intended for shop managers or admins a broken access control instance. The EUVD identifier EUVD-2026-48222 corroborates the NVD/Patchstack record.

RemediationAI

Update the YooKassa для WooCommerce plugin to a version higher than 2.16.1; no exact patched release version was confirmed in the available data, so administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/yookassa/vulnerability/wordpress-yukassa-dlya-woocommerce-plugin-2-16-1-broken-access-control-vulnerability for the latest confirmed fixed release. If an immediate update is not possible, a targeted compensating control is to disable open user registration on the WordPress site (Settings > General, uncheck 'Anyone can register'), which removes the low-friction path to obtaining a subscriber account; note this will prevent new customer account creation. Alternatively, use a WordPress firewall plugin (e.g., Patchstack, Wordfence) with a virtual patch rule for this CVE to block exploitation at the WAF layer without disrupting registration.