What is the CVSS score of EUVD-2026-48168?

EUVD-2026-48168 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Autopay dla WooCommerce EUVD-2026-48168

Q: Which versions of Autopay dla WooCommerce are affected by EUVD-2026-48168?

Broken access control in the Autopay dla WooCommerce WordPress plugin (versions <= 2.2.27) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization.

| CVE-2026-57425 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-vr28-58mv-3c4g

WordPress Authentication Bypass Wordpress Plugin Autopay Dla Woocommerce Wpdesk

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable plugin endpoint requires no authentication or interaction; scope is unchanged and confidentiality is unaffected, with only limited integrity and availability impact at plugin level.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:05 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.

AnalysisAI

Broken access control in the Autopay dla WooCommerce WordPress plugin (versions <= 2.2.27) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default-configured WordPress site running the affected plugin. The resulting impact spans limited integrity and availability degradation - consistent with unauthorized manipulation of payment or order-related plugin endpoints - with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

CWE-862 (Missing Authorization) indicates that the plugin fails to verify whether a caller has the rights to execute a given action before performing it - a classic WordPress broken access control pattern where REST API endpoints, AJAX handlers, or admin callbacks omit nonce checks or capability checks. The affected component is the wpdesk-developed Autopay dla WooCommerce plugin (CPE: cpe:2.3:a:wpdesk:autopay_dla_woocommerce:*:*:*:*:*:*:*:*), a WooCommerce payment gateway integration for the Autopay payment processor, which is primarily used in the Polish e-commerce market. WordPress plugins that integrate payment gateways frequently register AJAX endpoints that must be hardened against unauthenticated callers - a missing capability_check or missing check_ajax_referer call on such a handler would produce exactly this CWE-862 finding.

RemediationAI

No exact patched version number is confirmed in the available data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/pay-wp/vulnerability/wordpress-autopay-dla-woocommerce-plugin-2-2-27-broken-access-control-vulnerability should be consulted for the confirmed fixed release. Site administrators should update the Autopay dla WooCommerce plugin to the latest version available in the WordPress plugin repository immediately and verify it exceeds 2.2.27. If no patched version is yet available, the compensating control is to deactivate the plugin until a fix is released, accepting that Autopay payment processing will be unavailable during that period. Additionally, a web application firewall rule blocking unauthenticated POST requests to the plugin's registered AJAX or REST endpoints (identifiable via the plugin's source) can reduce exposure without full deactivation, though this requires identifying the specific vulnerable endpoint.