Yith Paypal Express Checkout For Woocommerce
Monthly
Missing authorization in YITH PayPal Express Checkout for WooCommerce up to 1.62.0 lets unauthenticated remote attackers perform unauthorized actions that modify site data, with integrity-only impact (CVSS 5.3). No public exploit has been identified at time of analysis, and the flaw is limited to sites running this specific plugin with the vulnerable endpoint network-reachable.
Unauthenticated attackers can exploit a missing authorization flaw in YITH PayPal Express Checkout for WooCommerce (versions up to and including 1.61.0) to gain unauthorized access to limited sensitive information. Tracked as CVE-2026-111409 and classified as CWE-862, the vulnerability has a CVSS 3.1 base score of 5.3 due to a low confidentiality impact only (C:L/I:N/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, but the plugin's default configuration exposes an unauthenticated endpoint.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization in YITH PayPal Express Checkout for WooCommerce up to 1.62.0 lets unauthenticated remote attackers perform unauthorized actions that modify site data, with integrity-only impact (CVSS 5.3). No public exploit has been identified at time of analysis, and the flaw is limited to sites running this specific plugin with the vulnerable endpoint network-reachable.
Unauthenticated attackers can exploit a missing authorization flaw in YITH PayPal Express Checkout for WooCommerce (versions up to and including 1.61.0) to gain unauthorized access to limited sensitive information. Tracked as CVE-2026-111409 and classified as CWE-862, the vulnerability has a CVSS 3.1 base score of 5.3 due to a low confidentiality impact only (C:L/I:N/A:N). No public exploit code or confirmed active exploitation has been identified at time of analysis, but the plugin's default configuration exposes an unauthenticated endpoint.
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.