EUVD-2026-95603
GHSA-r243-pfrp-259m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
DeliverySend crafted request to unprotected settings endpoint
-
ExploitMissing authorization check bypassed
-
ExecutionModify plugin/payment configuration
-
ImpactDegrade integrity and availability of checkout
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the target site run the codemstory pgall-for-woocommerce (워드프레스 결제 심플페이) plugin at any version up through 5.5.17 with a reachable vulnerable endpoint; per CVSS PR:N/UI:N no authentication or user interaction is needed, so default installations are affected. The practical limiting factors are the plugin's narrow deployment (a Korea-specific WooCommerce payment gateway) and the bounded impact - the missing authorization permits configuration/settings changes (I:L, A:L) rather than data disclosure or code execution, so realistic harm is restricted to settings tampering and checkout disruption rather than full site compromise. |
| Impact | This is a Missing Authorization flaw (CWE-862) in the 'pgall-for-woocommerce' WordPress payment plugin, carrying a CVSS 3.1 base score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N. The vector indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which normally elevates real-world concern. However, the impact is limited: C:N (no confidentiality loss), I:L and A:L (only partial integrity and availability impact), consistent with the referenced 'settings change' weakness rather than data theft or full compromise. No EPSS score, KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is therefore moderate and bounded by the plugin's limited deployment footprint (a Korean-market WooCommerce payment gateway) rather than being a widespread priority. Signals are internally consistent - there is no CVSS-versus-description conflict - but the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified and is inferred solely from the unauthenticated network vector. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable AJAX or settings endpoint of the plugin that fails to perform an authorization/capability check, allowing them to modify plugin configuration on a store running pgall-for-woocommerce at or below version 5.5.17. This could alter payment-gateway settings, disrupting checkout (availability) or tampering with configuration (integrity). No public POC is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Missing authorization in the codemstory SimplePay for WooCommerce payment plugin (slug pgall-for-woocommerce, marketed in Korean as 워드프레스 결제 심플페이) up to and including version 5.5.17 lets unauthenticated remote attackers change the plugin's payment gateway configuration - the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms no login and no user interaction are required. Rated CVSS 3.1 base 6.5 (Medium) with impact sub-scores C:N/I:L/A:L, so the realistic harm is tampering with settings and disruption of the checkout/payment flow rather than data disclosure or code execution, and the plugin's narrow, Korea-focused deployment further limits exposure; no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
RemediationAI
No vendor-released patch identified at time of analysis, and no exact fix version appears in the supplied data - the affected range runs through 5.5.17 and the only advisory is the Patchstack entry (https://patchstack.com/database/wordpress/plugin/pgall-for-woocommerce/vulnerability/wordpress-plugin-5-5-17-settings-change-vulnerability?_s_id=cve), so administrators should check the plugin's WordPress.org page and the vendor changelog for a release newer than 5.5.17 and upgrade as soon as one is published. Until a fix is confirmed, apply specific compensating controls: if the Korean payment gateway is not actually used for transactions, deactivate and remove pgall-for-woocommerce entirely (side effect: that payment method disappears from checkout, so confirm no live orders depend on it); if it must stay active, block unauthenticated POST requests to the plugin's settings-changing endpoints at the WAF or reverse proxy (side effect: broad rules against admin-ajax.php or the WordPress REST API can break unrelated front-end features, so scope rules to the plugin's own paths and action parameters, and validate against staging first). Because the flaw is a missing capability check rather than a bypassable one, there is no client-side or configuration toggle that closes it. Additionally, restrict wp-admin access by IP where operationally feasible, monitor the plugin's payment gateway settings for unexpected changes, review WooCommerce order and gateway configuration logs regularly, and rotate the payment gateway's API credentials if any unauthorized settings modification is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-862 (Missing Authorization) in a WordPress plugin that integrates a Korean payment gateway into WooCommerce checkout. The handler that writes the plugin's gateway settings - the kind of administrative action normally gated by a capability check such as current_user_can( 'manage_options' ) plus a WordPress nonce - is reachable without any authentication or prior privilege, so requests that should be reserved for a site administrator can be issued by an arbitrary remote client. Because the CVSS vector carries PR:N and UI:N, the defect is not a case of a valid low-privileged user escalating, but of the authorization gate being absent or incorrectly configured altogether; the Patchstack advisory names it a 'settings change' issue, which aligns with the bounded I:L/A:L metrics (settings modified, availability degraded) rather than full site compromise. The CPE cpe:2.3:a:codemstory:워드프레스_결제_심플페이:*:*:*:*:*:*:*:* and the EUVD entry EUVD-2026-95603 both describe the affected range as all versions up to 5.5.17, and the consequence of successful abuse is manipulation of payment gateway parameters (which can disable payment methods or misroute transaction configuration) on any WordPress/WooCommerce site running the plugin with a reachable endpoint.
Know when Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Missing authorization on a network-reachable endpoint needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); unauthorized settings changes give partial integrity and availability impact (I:L/A:L) with no data disclosure (C:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to a
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Unauthenticated path traversal in OrderConvo (the "Admin and Customer Messages After Order for WooCommerce" plugin), aff
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execu
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Exploit-DB