PayPal Brasil EUVD-2026-111742

Requires the PayPal Brasil para WooCommerce plugin (vendor odefranca) version ≤1.7.8 installed and active on a WordPress/WooCommerce store, with the BCDC payment gateway handler reachable over the network. The vulnerable activate/settings handlers do not verify that the caller is authorized, so exploitation needs no authentication (PR:N) and no user interaction. Limiting factors: impact is confined to toggling and overwriting the payment gateway configuration (integrity only) - there is no confidentiality exposure or code execution, and the practical consequence is removal/misconfiguration of PayPal at checkout rather than site compromise.

This is a genuine but limited-severity issue, correctly prioritized below emergency level. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) is internally consistent with the description: a CWE-862 missing-authorization flaw reachable remotely by unauthenticated attackers with low complexity and no user interaction, but with impact confined to integrity (C:N, A:N). The vuln.today decision label is 'this_month' rather than 'act_now'/'emergency', which aligns with the moderate score. No EPSS score was supplied, so exploitation probability cannot be quantified. KEV status is not indicated (treat as not listed), so there is no confirmed active exploitation. The supplied references are a Wordfence advisory, WordPress plugin trac source lines showing the vulnerable handlers, and the fix changeset - these identify the flaw and patch, not a packaged exploit, so no working public exploit code is evidenced. The practical risk is reputational/operational rather than a data breach: an attacker can toggle or reconfigure the payment gateway, but cannot read data or directly compromise the host. This is a real priority for affected Brazilian WooCommerce merchants (silent loss of a checkout option affects revenue) but not a high-urgency RCE-class event.

An unauthenticated attacker sends a crafted request to the plugin's BCDC gateway activation/settings handler, which fails to verify the caller's authorization. The attacker disables the PayPal Brasil BCDC gateway or overwrites its WooCommerce gateway settings, silently removing PayPal from checkout for all customers of the store. No public working exploit is evidenced in the provided sources, though the vulnerable code paths are publicly documented in the plugin source.