CVE-2026-32578: WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

Q: What level of access does an attacker need?

An attacker needs Subscriber-level access to the affected WordPress site. The vulnerability is not described as exploitable by an unauthenticated visitor.

Q: What security impact is indicated by the available severity data?

The supplied vector indicates low integrity impact and high availability impact, with no confidentiality impact. Exploitation is rated network-accessible, low complexity, and does not require user interaction.

Published Oct 6, 2026

Updated

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.

Affected Software

1 affected component

ECPay ECPay Ecommerce for WooCommerce<=1.1.2606090

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

An attacker needs Subscriber-level access to the affected WordPress site. The vulnerability is not described as exploitable by an unauthenticated visitor.

What security impact is indicated by the available severity data?

The supplied vector indicates low integrity impact and high availability impact, with no confidentiality impact. Exploitation is rated network-accessible, low complexity, and does not require user interaction.

CVE-2026-32578: WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

What security impact is indicated by the available severity data?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What security impact is indicated by the available severity data?