CVE-2026-27401: WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YITH PayPal Express Checkout for WooCommerceto a version that resolves this vulnerability.Fixed in 1.62.1
Event History
Frequently Asked Questions
Which installations are affected?
Installations of YITH PayPal Express Checkout for WooCommerce are affected through version 1.62.0. The available data does not identify a lower affected version or any configuration-specific limitation.
Does exploitation require an authenticated account or user interaction?
No. The supplied vector indicates that exploitation is network-accessible, requires no privileges, and requires no user interaction.
What is the expected impact?
The supplied severity vector indicates an integrity impact only, with no identified confidentiality or availability impact. The issue is classified as medium severity with a 5.3 score.