WooCommerce Deposits Plugin EUVD-2026-76215

Exploitation requires that the target WordPress site has the Deposits and Partial Payments for WooCommerce plugin installed, active, and at version 3.1.0 or earlier. The attack is fully unauthenticated (PR:N) and requires no user interaction. The specific limiting factors are: (1) the site must be running WooCommerce alongside this specific plugin, and (2) the impact is confined to integrity manipulation of deposit/payment-related data rather than full compromise - there is no confidentiality or availability impact per the CVSS vector. No special network position or configuration is required beyond reaching the WordPress AJAX endpoint over HTTP/HTTPS.

The CVSS 3.1 base score of 5.3 (Medium) reflects a network-accessible, zero-complexity, zero-privilege flaw with limited integrity impact and no confidentiality or availability consequence (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The practical real-world risk is constrained by the I:L rating - while any unauthenticated actor on the internet can trigger the vulnerable endpoint, the blast radius is bounded to partial payment or deposit state manipulation rather than full site compromise or data exfiltration. No EPSS score was supplied and the vulnerability is absent from the CISA KEV catalog, suggesting no confirmed in-the-wild exploitation at time of analysis. For most WooCommerce store operators, this represents a meaningful but non-critical integrity risk; even a mid-sized municipal IT team in tczew running an e-commerce deployment on this plugin should treat this as a routine patching priority rather than an emergency incident response trigger. The absence of a confirmed fix version in the available data is a minor gap - patch status should be verified directly against the Patchstack advisory and the WordPress plugin repository changelog.

An unauthenticated attacker enumerates or infers the vulnerable WordPress AJAX action name by inspecting the plugin source code or publicly available decompilations, then sends a crafted POST request to wp-admin/admin-ajax.php (or the equivalent REST endpoint) invoking the unprotected action. Because no authorization check exists, the server executes the operation - potentially altering deposit percentages, bypassing partial payment requirements, or modifying order-level payment state - directly on the target WooCommerce store. No public exploit code has been identified at time of analysis.