CVE-2026-114699: WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability
Published Oct 22, 2026
·Updated
Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.
Affected Software
1 affected component
wordpress/yookassa<=2.17.3
Event History
Oct 22, 2026
CVE Published
via MITRE·08:53 AM
Data Sourced
via MITRE·08:53 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
The issue affects the WordPress ЮKassa для WooCommerce plugin through version 2.17.3. The available data does not identify a safe fixed version.
2
Does exploitation require an authenticated WordPress account or user interaction?
No. The supplied CVSS vector indicates network-reachable exploitation with no privileges required and no user interaction required.
3
What is the expected impact if exploited?
The reported impact is limited confidentiality impact. No integrity or availability impact is indicated in the supplied CVSS vector.