CVE-2026-108493

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Unauthenticated attackers can perform unauthorized modifications to payment configurations over the network. They need only direct network access to the target WordPress site.

Root cause

The plugin fails to perform authorization checks, allowing unauthenticated requests to bypass access control.

Affected systems

Karolína Vyskočilová Pay for Payment for WooCommerce (woocommerce-pay-for-payment) through 3.0.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Update to a version newer than 3.0.1 if available from the vendor; if no patch exists yet, deactivate and uninstall the woocommerce-pay-for-payment plugin.

shell

$ wp plugin deactivate woocommerce-pay-for-payment

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooCommerce: from n/a through 3.0.1.

References

https://patchstack.com/database/wordpress/plugin/woocommerce-pay-for-payment/vulnerability/wordpress-pay-for-payment-for-woocommerce-plugin-3-0-1-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-108493