Live › vulnerability › CVE-2026-114699
Go to dashboardThe ЮKassa для WooCommerce (yookassa) plugin lacks an authorization check on some functionality, so access control can be bypassed through misconfigured access levels. The sources do not say exactly which action an attacker can take once past the check.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WooCommerce stores that run the ЮKassa для WooCommerce (yookassa) plugin at version 2.17.3 or earlier are affected. The sources do not describe the exact configuration that makes access control exploitable, so sites that run the plugin with default settings should still check. Stores that do not use this payment plugin can skip it.
No product ranges from the sources yet.
wp-content/plugins/yookassa/ header of the main plugin file2.17.3 or earlier, which the sources name as affected2.17.3; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-114699")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.