YITH PayPal Express EUVD-2026-112750

Exploitation requires only that a WooCommerce site be running YITH PayPal Express Checkout for WooCommerce at a version up to and including 1.62.0, with the vulnerable (likely AJAX or REST) endpoint network-reachable. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed, so default installations appear exposed. The precise endpoint, parameter, or configuration that triggers the missing authorization check is not described in the available sources. The main LIMITING factor is impact scope: the flaw affects integrity only (C:N/A:N), so it enables an unauthorized action rather than data theft or denial of service, and it is naturally bounded to sites that have this specific plugin installed and activated.

This is a moderate-severity Missing Authorization / Broken Access Control flaw (CWE-862) with CVSS 5.3 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vector indicates a network-reachable, low-complexity, unauthenticated issue requiring no user interaction, but with impact limited to integrity only (C:N/I:L/A:N) - meaning an attacker can perform some unauthorized state-changing action (e.g. invoking a plugin function that should be access-controlled) without being able to read sensitive data or disrupt availability. The vuln.today decision label is 'this_month', signaling a prioritized-but-not-emergency triage rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no public exploit were supplied, so there is no evidence of active or widespread exploitation; the only source is a single Patchstack advisory. The signals are internally consistent (unauthenticated network access is plausible for a WordPress REST/AJAX endpoint), so this reads as a genuine but bounded web-app access-control issue rather than a false high - the low integrity-only impact and absence of exploitation signals keep real-world urgency moderate. EPSS and POC status are MISSING and should be verified; absence is not confirmation of low risk.

A remote, unauthenticated attacker sends a crafted request to a plugin endpoint (AJAX/REST action) that fails to enforce an authorization/capability check, allowing them to trigger a privileged operation they should not be able to reach. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access to a store running the vulnerable plugin and no credentials or victim interaction. No public proof-of-concept or exploit code was identified in the provided data.