Skip to main content

Vipps for WooCommerce CVE-2026-97259

| EUVDEUVD-2026-89960 MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-09-30 Patchstack GHSA-p263-vqc6-hg4w
WordPress Authentication Bypass Woocommerce Wordpress Plugin Pay With Vipps For Woocommerce
5.3
CVSS 4.0 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Remote authenticated low-privilege user (PR:L) triggers an IDOR with no interaction; impact is limited unauthorized data read (C:L), no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Metadata Corrected
Sep 30, 2026 - 15:40 vuln.today
tag: Woocommerce added
Analysis Generated
Sep 30, 2026 - 15:05 vuln.today
CVE Published
Sep 30, 2026 - 14:10 cve.org
MEDIUM 5.3

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.

AnalysisAI

An authorization bypass (IDOR, CWE-639) in the Pay with Vipps for WooCommerce WordPress plugin, versions through 6.2.4, lets an authenticated, logged-in user retrieve order or customer records belonging to other users by supplying a manipulated, user-controlled object key. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) shows the attacker must already hold a valid account (PR:L), that no user interaction is needed, and that the impact is limited to low confidentiality loss with no integrity or availability effect. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated account on the target WooCommerce store (PR:L) - the attacker must be a logged-in user before manipulating the user-controlled object key. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a moderate-severity, low-real-risk issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The supplied intelligence contains no vendor-released fixed version, so no vendor-released patch was identified at time of analysis and the exact patched release cannot be cited; administrators should check the plugin's WordPress.org page and the WP Hosting AS vendor channel for a release newer than 6.2.4 and upgrade as soon as one is published, since the advisory is tied to the 6.2.4 code line. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Woocommerce

View all
CVE-2017-17058 HIGH POC
7.5 Nov 29

The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
CVE-2021-24212 CRITICAL POC
9.8 Apr 05

The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
CVE-2022-50972 CRITICAL POC
9.3 Jun 20

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by

CVE-2020-35627 HIGH POC
8.8 Dec 28

Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
CVE-2026-14962 HIGH POC
8.6 Sep 09

Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
CVE-2026-92404 HIGH POC
7.5 Sep 19

Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync

CVE-2023-34000 HIGH POC
7.5 Jun 14

Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
CVE-2020-11497 HIGH POC
7.5 Aug 26

An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
CVE-2026-74925 HIGH POC
7.2 Sep 11

Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
CVE-2023-47777 MEDIUM POC
6.5 Nov 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
CVE-2026-103378 MEDIUM POC
6.5 Oct 07

Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
CVE-2026-93509 MEDIUM POC
6.5 Oct 08

Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Share

CVE-2026-97259 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy