EUVD-2026-108080
GHSA-rhv8-2j2w-63wq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated HTTP request to plugin endpoint
-
ExploitBypass missing authorization check (CWE-862)
-
ImpactAccess restricted data or function with low confidentiality impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected software is the ЮKassa для WooCommerce (yookassa) WordPress/WooCommerce plugin on versions through 2.17.3. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated reachability with no user interaction against the plugin, but the specific endpoint, action, or configuration that triggers the missing authorization is not described in the available sources. Limiting factors: exploitation requires the vulnerable plugin to be installed and active on a WooCommerce store, impact is confined to low confidentiality (no integrity or availability effect), and the referenced description only characterizes it as exploiting incorrectly configured access-control levels without naming the exact feature. |
| Impact | This is a medium-severity issue (CVSS 5.3) whose signals point to limited rather than urgent real-world risk. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates a remotely reachable, low-complexity, unauthenticated flaw (PR:N), but impact is confined to low confidentiality (C:L) with no integrity or availability effect - consistent with a missing authorization check (CWE-862) exposing restricted data or a restricted function rather than a full compromise. No EPSS probability, CISA KEV listing, or PoC/exploit reference is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today priority is 'this_month' (not act_now or emergency), reinforcing a routine-patch posture. One caution: the input Tags label this 'Authentication Bypass', but the CWE and the referenced Patchstack entry describe broken access control / missing authorization - distinct from authentication bypass - so the tag overstates the mechanism. Net: a genuine but moderate access-control weakness, appropriate to remediate on a normal monthly cycle rather than as an emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a request to a plugin endpoint or action that lacks a proper authorization check, reaching functionality or data intended to be restricted. Per the CVSS vector the result is limited information disclosure (C:L) with no modification or disruption. No public exploit code or PoC reference is included in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Missing authorization (CWE-862) in the ЮKassa для WooCommerce (yookassa) WordPress plugin affects all versions through 2.17.3 and lets remote, unauthenticated requests reach functionality that should require proper access-control checks. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) indicates the exposure is limited to low confidentiality impact, with no integrity or availability effect and no user interaction required. The specific endpoint, action, or plugin configuration that triggers the missing check is not described in the available sources, and there is no CISA KEV entry or confirmed public exploit code at time of analysis; the vuln.today priority decision is 'this_month', pointing to limited rather than urgent real-world risk.
RemediationAI
No vendor-released patch is identified in the available data, and no fixed version number is listed for the yookassa plugin; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/yookassa/vulnerability/wordpress-yukassa-dlya-woocommerce-plugin-2-17-3-broken-access-control-vulnerability?_s_id=cve for the current fixed release and update the plugin as soon as one is published. Because the vulnerable endpoint or action is not described in the available sources, no targeted workaround can be recommended from this data; the only exposure-removing action available is deactivating the yookassa plugin, whose trade-off is that ЮKassa payment processing on the WooCommerce store stops working. Patch status at time of analysis: no vendor-released patch identified.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is a WordPress plugin that integrates the ЮKassa (YooMoney) payment gateway with WooCommerce stores. The root cause class is CWE-862, Missing Authorization: a function or route that should verify the caller's capability or nonce performs its action without that check, so an unauthenticated visitor can invoke it. Because the plugin runs inside WordPress, such flaws typically sit on registered REST routes, admin-ajax actions, or front-end callback handlers, but the available sources do not identify which handler is at fault, so the trigger is not described in the available sources. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects remote reachability without privileges or user interaction, while S:U/C:L/I:N/A:N caps the assessed impact at low confidentiality loss; integrity and availability are unaffected per the assessment.
Know when Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Missing authorization reachable remotely without auth or interaction (AV:N/AC:L/PR:N/UI:N); impact limited to low confidentiality disclosure, so I:N and A:N.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
Unauthenticated remote code execution in Print Invoice & Delivery Notes for WooCommerce through 5.8.0 lets remote attack
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to a
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Unauthenticated path traversal in OrderConvo (the "Admin and Customer Messages After Order for WooCommerce" plugin), aff
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execu
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
Exploit-DB