What is the CVSS score of EUVD-2026-57864?

EUVD-2026-57864 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of CLINK WooCommerce Gateway are affected by EUVD-2026-57864?

The Bitcoin Lightning Payment Gateway for WooCommerce (CLINK) plugin versions 1.0.7 and below contain broken access controls exposing payment processing endpoints to unauthenticated remote attackers,…

How to fix or mitigate EUVD-2026-57864?

Within 24 hours, inventory all WordPress instances for CLINK plugin versions 1.0.7 or below and immediately deactivate the plugin to eliminate attack surface. Within 7 days, execute migration to alternative payment gateway solutions (recommend industry-standard processors with established security track records) since no vendor patch is currently available. Within 30 days, complete the transition away from CLINK or, if business constraints require temporary retention, deploy Web Application Firewall (WAF) rules blocking unauthorized AJAX and REST API requests to payment endpoints, combined with IP whitelisting for all WordPress administrative access and enhanced transaction logging for anomaly detection.

CLINK WooCommerce Gateway EUVD-2026-57864

| CVE-2026-66431 HIGH

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-984v-v3q8-p4hq

WordPress Authentication Bypass Wordpress Plugin Bitcoin Lightning Payment Gateway For Woocommerce Via Clink

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated endpoint with no interaction needed; integrity-only impact aligns with payment state manipulation, no data exposure or denial of service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:39 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.

AnalysisAI

Broken access control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) versions 1.0.7 and below exposes one or more plugin endpoints - almost certainly WordPress AJAX handlers or REST API routes - without the required capability checks, allowing unauthenticated remote attackers to perform privileged actions with high integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms no credentials are needed and exploitation requires no user interaction, making this trivially scriptable against any internet-facing WordPress store running the affected plugin. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the attack conditions are permissive enough to make opportunistic exploitation straightforward.

Technical ContextAI

CWE-862 (Missing Authorization) describes code paths that execute privileged operations without first verifying that the calling principal holds the necessary permission. In WordPress plugin architecture, this commonly manifests as AJAX action callbacks registered via wp_ajax_nopriv_ (allowing unauthenticated callers) or REST API routes registered without a permission_callback, where the handler performs sensitive operations - in this case actions tied to the Bitcoin Lightning Network payment gateway. The affected product, identified by CPE cpe:2.3:a:woompaloompa:bitcoin_lightning_payment_gateway_for_woocommerce_(via_clink):*:*:*:*:*:*:*:*, is a WooCommerce extension that integrates the CLINK service to process Lightning Network Bitcoin payments. Because Lightning payments involve real-time payment state (invoices, settlement confirmations, order status updates), unauthorized write access to these operations carries direct financial risk - potential for order status manipulation, invoice spoofing, or payment bypass.

RemediationAI

No specific patched version number was identified in the provided input data; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/clink-gateway-for-woocommerce/vulnerability/wordpress-bitcoin-lightning-payment-gateway-for-woocommerce-via-clink-plugin-1-0-7-broken-access-control-vulnerability should be consulted directly to confirm whether a fixed release (version 1.0.8 or later) has been published to the WordPress plugin repository. As an immediate compensating control, site operators can temporarily deactivate the CLINK plugin to eliminate the attack surface entirely - this will disable Lightning payment processing but removes all exploitation risk. Alternatively, a Web Application Firewall rule blocking unauthenticated POST requests to the specific vulnerable AJAX action or REST endpoint (identifiable via the Patchstack advisory detail page) can provide targeted protection without disabling the plugin, though this requires identifying the exact endpoint name. Restricting wp-admin/admin-ajax.php or REST API access to authenticated sessions at the network layer is overly broad and will break legitimate storefront functionality.