Live › vulnerability › CVE-2026-111409
Go to dashboardThe YITH PayPal Express Checkout plugin for WooCommerce lacks an authorization check on some functionality, so a user may reach actions they should not. The sources do not say which action or what data an attacker can read or change.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running YITH PayPal Express Checkout for WooCommerce at version or earlier are in scope. The sources do not say which user roles or configurations make a site exposed, so unknown whether sites with the plugin disabled or limited access are safe.
1.61.0No product ranges from the sources yet.
wp plugin get yith-paypal-express-checkout-for-woocommerce --field=version1.61.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-111409")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.