Description
Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.
Published: 2026-07-23
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthenticated broken access control flaw in the WordPress Payment Gateway for PayPal on WooCommerce plugin up to version 9.1.4. Based on the description, it is inferred that this flaw enables an unauthenticated user to access privileged areas of the plugin, potentially leading to unauthorized configuration changes or data exposure. The weakness corresponds to CWE-862.

Affected Systems

The affected product is Easy Payment: Payment Gateway for PayPal on WooCommerce. Versions 9.1.4 and earlier are vulnerable.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% shows that exploitation activity is currently very low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is web-based, requiring unauthenticated access to the plugin’s interface.

Generated by OpenCVE AI on August 3, 2026 at 22:18 UTC.

Remediation

Vendor Solution

Update the WordPress Payment Gateway for PayPal on WooCommerce Plugin to the latest available version (at least 9.1.5).

OpenCVE Recommended Actions

  • Upgrade the WordPress Payment Gateway for PayPal on WooCommerce plugin to version 9.1.5 or later.
  • If an immediate upgrade is not possible, disable the PayPal payment gateway or restrict administrative access to the plugin’s settings via server‑level access controls.
  • If the plugin remains installed, review user role capabilities to ensure no unprivileged accounts have access to payment gateway settings and remove any unused administrator accounts.

Generated by OpenCVE AI on August 3, 2026 at 22:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Easy Payment
Easy Payment payment Gateway For Paypal On Woo Commerce
Wordpress
Wordpress wordpress
Vendors & Products Easy Payment
Easy Payment payment Gateway For Paypal On Woo Commerce
Wordpress
Wordpress wordpress

Thu, 23 Jul 2026 11:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.
Title WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Easy Payment Payment Gateway For Paypal On Woo Commerce
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-23T14:55:59.346Z

Reserved: 2026-07-05T21:27:56.024Z

Link: CVE-2026-59547

cve-icon Vulnrichment

Updated: 2026-07-23T14:55:39.869Z

cve-icon NVD

Status : Deferred

Published: 2026-07-23T12:18:33.557

Modified: 2026-07-23T16:17:29.957

Link: CVE-2026-59547

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T22:30:03Z

Weaknesses