CVE-2026-108493: WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pay for Payment for WooCommerceto a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Which installations are affected?
Pay for Payment for WooCommerce versions through 3.0.1 are affected. The available data does not identify a fixed version.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates that the issue is remotely exploitable without privileges and without user interaction.
What could a successful attacker do?
The reported impact is limited to integrity, meaning an attacker may be able to make unauthorized modifications. No confidentiality or availability impact is reported.
Is a default configuration known to be affected?
The available information does not state whether default plugin settings are affected. It describes the issue as incorrectly configured access-control security levels.