CVE-2026-111409: WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

Q: Which deployments are affected?

Affected versions are YITH PayPal Express Checkout for WooCommerce versions through 1.61.0. The available data does not identify a lower affected version bound.

Q: Does exploitation require an authenticated WordPress account or user interaction?

No. The supplied vector indicates network-reachable exploitation with no privileges required and no user interaction required.

Q: What is the expected impact if exploited?

The stated impact is limited confidentiality impact. Integrity and availability impacts are not indicated.

Published Oct 16, 2026

Updated

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.

Affected Software

1 affected component

YITH YITH PayPal Express Checkout for WooCommerce<=1.61.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade YITH PayPal Express Checkout for WooCommerce to a version that resolves this vulnerability.
Fixed in 1.62.0

Event History

Oct 16, 2026

CVE Published

via MITRE·12:52 PM

Data Sourced

via MITRE·12:52 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected versions are YITH PayPal Express Checkout for WooCommerce versions through 1.61.0. The available data does not identify a lower affected version bound.

Does exploitation require an authenticated WordPress account or user interaction?