CVE-2026-108492

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Unauthenticated remote attackers can perform unauthorized actions or modify data via improperly restricted plugin endpoints. They only need network access to the WordPress site.

Root cause

The plugin fails to enforce proper authorization checks on actions due to missing access control verification.

Affected systems

Fullworks Plugins Quick Paypal Payments through 6.0.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade Quick Paypal Payments to a version newer than 6.0.3 if available, or deactivate and remove the plugin immediately if no patch exists.

shell

$ wp plugin deactivate quick-paypal-payments

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3.

References

https://patchstack.com/database/wordpress/plugin/quick-paypal-payments/vulnerability/wordpress-quick-paypal-payments-plugin-6-0-3-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-108492