CVE-2026-16058

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/d32d7086-9a43-4d98-80d7-18a3f82797bb/

Configurations

No configuration.

History

22 Oct 2026, 16:09

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress YayCurrency anterior a la versión 3.3.5 no realiza ninguna comprobación de capacidad o propiedad en varios de sus manejadores de integración multi-vendedor que son accesibles por usuarios no autenticados, permitiendo a cualquiera leer los totales de pedidos de la tienda y las ganancias de sus proveedores, los libros de contabilidad de saldos y los historiales de retiro al iterar identificadores.

Information

Published : 2026-08-19 06:17

Updated : 2026-10-22 16:09

NVD link : CVE-2026-16058

Mitre link : CVE-2026-16058

CVE.ORG link : CVE-2026-16058

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-16058", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16058", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T13:26:53.179593Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "YayCurrency", "versions": [{"status": "affected", "version": "0", "lessThan": "3.3.5", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-19T06:17:34.670", "references": [{"url": "https://wpscan.com/vulnerability/d32d7086-9a43-4d98-80d7-18a3f82797bb/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers."}, {"lang": "es", "value": "El plugin de WordPress YayCurrency anterior a la versi\u00f3n 3.3.5 no realiza ninguna comprobaci\u00f3n de capacidad o propiedad en varios de sus manejadores de integraci\u00f3n multi-vendedor que son accesibles por usuarios no autenticados, permitiendo a cualquiera leer los totales de pedidos de la tienda y las ganancias de sus proveedores, los libros de contabilidad de saldos y los historiales de retiro al iterar identificadores."}], "lastModified": "2026-10-22T16:09:59.560", "sourceIdentifier": "contact@wpscan.com"}