Description
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
Published: 2026-10-06
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized privileged actions via broken access control
Action: Patch
AI Analysis

Impact

A broken access control flaw in the WordPress plugin ECPay Ecommerce for WooCommerce allows attackers who can reach the plugin's endpoints to read or manipulate subscription data of other users. An attacker can elevate privileges without authentication, enabling unauthorized changes to transaction records, membership status, or financial information. This weakness is classified as CWE-862 and results in loss of confidentiality and integrity for registrants.

Affected Systems

The vulnerability targets the WordPress plugin ECPay Ecommerce for WooCommerce from techsupport. Versions with a revision number of 1.1.2606090 or earlier are affected.

Risk and Exploitability

The CVSS score of 7.1 reflects moderate to high severity. The EPSS score is less than 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog, implying no widespread exploitation has been reported to date. Nonetheless, the flaw can be exploited remotely from any web‑accessible location that can reach the plugin’s endpoints, making it a significant risk in environments where the plugin handles ecommerce transactions.

Generated by OpenCVE AI on October 7, 2026 at 06:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the ECPay Ecommerce for WooCommerce plugin to a version newer than 1.1.2606090.
  • After applying the upgrade, test that subscription endpoints are no longer accessible to non‑administrative users to confirm access controls are enforced.
  • Configure firewall rules or use a WordPress access‑control plugin to restrict privileged operations to authorized accounts only.

Generated by OpenCVE AI on October 7, 2026 at 06:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
Title WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-06T10:31:41.205Z

Reserved: 2026-03-12T11:12:57.708Z

Link: CVE-2026-32578

cve-icon Vulnrichment

Updated: 2026-10-06T10:30:56.571Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T09:17:43.460

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-32578

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T06:30:13Z

Weaknesses