What is the CVSS score of CVE-2026-73353?

CVE-2026-73353 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-73353?

Yes, a patch is available for CVE-2026-73353. Update the affected software to the latest version immediately.

Revolut WooCommerce Gateway CVE-2026-73353

Q: Which versions of Revolut WooCommerce Gateway are affected by CVE-2026-73353?

Broken access control in Revolut Gateway for WooCommerce allows unauthenticated remote attackers to reach restricted plugin endpoints and read protected data, yielding low confidentiality exposure…. A patch is available.

EUVD-2026-57913 MEDIUM

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-2jgr-749r-2m85

Authentication Bypass WordPress Revolut Gateway For Woocommerce

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network access with no complexity, scope unchanged, and only partial confidentiality disclosure; no integrity or availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:10 vuln.today

Patch available

Aug 13, 2026 - 15:02 EUVD

CVE Published

Aug 13, 2026 - 13:37 cve.org

MEDIUM 5.3

DescriptionCVE.org

Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.

AnalysisAI

Broken access control in Revolut Gateway for WooCommerce allows unauthenticated remote attackers to reach restricted plugin endpoints and read protected data, yielding low confidentiality exposure with no integrity or availability impact. All plugin versions below 4.22.10 on WordPress/WooCommerce installations are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WooCommerce site with Revolut plugin active

Delivery

Enumerate unprotected plugin endpoint from public source

Exploit

Send unauthenticated HTTP request to restricted handler

Execution

Server processes request without authorization check

Impact

Retrieve restricted order or plugin configuration data

Access

Identify WooCommerce site with Revolut plugin active

Delivery

Enumerate unprotected plugin endpoint from public source

Exploit

Send unauthenticated HTTP request to restricted handler

Execution

Server processes request without authorization check

Impact

Retrieve restricted order or plugin configuration data

Vulnerability AssessmentAI

Exploitation	No authentication is required - the CVSS vector confirms PR:N and AV:N, meaning any network-accessible WordPress site running the vulnerable plugin can be targeted without credentials. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) scores 5.3 (Medium), reflecting easy unauthenticated network access but only low confidentiality impact with no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with no account or session on the target WooCommerce store sends a crafted HTTP request - either a wp-admin AJAX call or a REST API request - targeting one of the Revolut plugin's unprotected action handlers. Because no authorization check exists, the server processes the request and returns restricted data such as order details, plugin configuration values, or partial transaction records. …
Remediation	Update the Revolut Gateway for WooCommerce plugin to version 4.22.10 or later via the WordPress admin dashboard (Plugins → Update Available) or by downloading the patched release directly from the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report.