Missing authorization in YayCommerce YayExtra allows attackers with sufficient permissions to perform actions normally restricted to site administrators. The vulnerability can be exploited by sending crafted HTTP requests to the plugin’s management endpoints, resulting in unauthorized data disclosure, modification, or deletion. The weakness falls under CWE‑862, reflecting a failure to enforce access control policies.

WordPress sites using the YayCommerce YayExtra plugin, versions up to and including 1.5.2. The plugin is distributed as a WordPress plugin; any site with this legacy version is susceptible.

The CVSS score of 7.6 indicates high severity, yet the EPSS score of less than 1% suggests that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, further reducing the probability of a widespread attack. Attackers would need network access to the site and the ability to send requests to the plugin’s endpoints, a condition that is typically met by remote users browsing the public web page. If exploited, the attacker could gain the same privileges as a site administrator.