WooCommerce Deposits EUVD-2026-95623

Requires an authenticated low-privilege account on the target WooCommerce site (PR:L) - typically achievable where customer/subscriber self-registration is enabled, which is common for storefronts. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so no special timing or non-default configuration is indicated by the CVSS vector. The specific plugin feature/endpoint lacking the authorization check is not named in the description, so the exact action an attacker can abuse is not confirmed from available data. Limiting factors: exploitation is bounded to integrity impact only (C:N/A:N), and an attacker must first hold valid credentials rather than acting fully unauthenticated.

This is a medium-severity (CVSS 6.5) missing-authorization flaw (CWE-862) in the Magepeople Deposits and Partial Payments for WooCommerce plugin, affecting all versions through 4.0.1. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N indicates network-reachable, low-complexity exploitation requiring only low-privilege authentication (PR:L), with no user interaction, yielding high integrity impact but no confidentiality or availability impact - consistent with a broken-access-control issue that lets an authenticated low-privilege actor (e.g., a WooCommerce customer/subscriber account) perform actions or modify data they should not be authorized to change. No EPSS score was supplied in the input, and the vulnerability is NOT listed in CISA KEV, with no public proof-of-concept referenced - only a Patchstack advisory. Therefore there is no public exploit identified at time of analysis, and no signal of active or widespread exploitation. On balance this is a legitimate but moderate-priority issue rather than an emergency: the authenticated-only requirement (PR:L) and integrity-only impact limit real-world risk, though self-registration being common on WooCommerce storefronts makes the PR:L barrier low in practice. Note the conflict to verify: the input Tags label this 'Authentication Bypass,' but the CWE (Missing Authorization) and the Patchstack title ('Broken Access Control') describe an authorization/access-control failure, not authentication bypass - defenders should treat it as broken access control.

An attacker registers or already holds a low-privilege account (such as a customer or subscriber) on a WooCommerce store running the vulnerable Deposits and Partial Payments plugin. Because an authorization check is missing on one or more plugin actions, the attacker sends a crafted authenticated HTTP request to invoke functionality or modify deposit/payment data they should not be permitted to alter. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or conditions are needed once authenticated.