Yaypricing
Monthly
Missing capability checks across multiple REST API routes in the YayPricing WordPress plugin (all versions before 3.5.7) allow any subscriber-level authenticated user to overwrite a WooCommerce store's complete pricing configuration and extract private coupon codes. The plugin incorrectly relies on a shared nonce as its sole authorization gate rather than WordPress capability checks, a fundamental access control failure classified under CWE-284. A publicly available exploit exists per WPScan (EUVD-2026-53116), though EPSS sits at 0.14% (4th percentile), indicating low automated exploitation activity; CISA KEV listing is absent, so active exploitation in the wild is not confirmed.
Broken access control in YayPricing ≤ 3.5.6 allows authenticated subscribers to modify pricing data or cause service disruption. The vulnerability, rated medium severity (CVSS 5.4), stems from missing authorization checks in an endpoint that should be restricted to higher-privilege roles. No public exploit code or active exploitation is known at the time of analysis.
Missing capability checks across multiple REST API routes in the YayPricing WordPress plugin (all versions before 3.5.7) allow any subscriber-level authenticated user to overwrite a WooCommerce store's complete pricing configuration and extract private coupon codes. The plugin incorrectly relies on a shared nonce as its sole authorization gate rather than WordPress capability checks, a fundamental access control failure classified under CWE-284. A publicly available exploit exists per WPScan (EUVD-2026-53116), though EPSS sits at 0.14% (4th percentile), indicating low automated exploitation activity; CISA KEV listing is absent, so active exploitation in the wild is not confirmed.
Broken access control in YayPricing ≤ 3.5.6 allows authenticated subscribers to modify pricing data or cause service disruption. The vulnerability, rated medium severity (CVSS 5.4), stems from missing authorization checks in an endpoint that should be restricted to higher-privilege roles. No public exploit code or active exploitation is known at the time of analysis.