CVE-2026-16058: YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration
The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Stores using the YayCurrency WordPress plugin before 3.3.5 with its multi-vendor integration handlers exposed are affected. The disclosed data includes order totals and vendor earnings, balance ledgers, and withdrawal histories.
What does an attacker need to exploit it?
No authentication is required. An attacker can iterate identifiers to retrieve the affected order and vendor financial data.
How can I determine whether my site is affected?
Check whether YayCurrency is installed at a version earlier than 3.3.5 and whether the site uses the affected multi-vendor integration. The issue is associated with Dokan integration handlers.