{"id":"CVE-2026-114699","kind":"vulnerability","aliases":["CVE-2026-114699"],"related":[],"title":"WooCommerce YooKassa plugin: missing authorization check through version 2.17.3","description":"Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.","summary":"The ЮKassa для WooCommerce (yookassa) plugin lacks an authorization check on some functionality, so access control can be bypassed through misconfigured access levels. The sources do not say exactly which action an attacker can take once past the check.","severity":"medium","cvss":5.3,"epss":0.00187,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payments","woocommerce","wordpress","yookassa"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/yookassa/` header of the main plugin file\n- Confirm whether the installed version is `2.17.3` or earlier, which the sources name as affected","fix":"- Update the ЮKassa для WooCommerce (yookassa) plugin to a version later than `2.17.3`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-10-22T09:17:15+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:24+00:00","updated_at":"2026-10-25T04:20:24+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:20:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update the ЮKassa для WooCommerce (yookassa) plugin to a version later than `2.17.3`; the exact fixed version is unknown from the sources","reach":"internet","title":"WooCommerce YooKassa plugin: missing authorization check through version 2.17.3","impact":"medium","summary":"The ЮKassa для WooCommerce (yookassa) plugin lacks an authorization check on some functionality, so access control can be bypassed through misconfigured access levels. The sources do not say exactly which action an attacker can take once past the check.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","yookassa","payments"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Unauthorized users reach payment plugin functions they should not access","analyst_note":"Find the vendor advisory or patch notes for yookassa above 2.17.3 to confirm the fixed version and the specific unauthorized action, at https://nvd.nist.gov/vuln/detail/CVE-2026-114699.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/yookassa/` header of the main plugin file\n- Confirm whether the installed version is `2.17.3` or earlier, which the sources name as affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WooCommerce stores that run the ЮKassa для WooCommerce (yookassa) plugin at version 2.17.3 or earlier are affected. The sources do not describe the exact configuration that makes access control exploitable, so sites that run the plugin with default settings should still check. Stores that do not use this payment plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000656,"input_tokens":3361,"output_tokens":640,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114699':12A,15A '-2026':11A,14A '2.17.3':9A,85C 'access':35B,42B,73C 'action':51B 'affect':78C 'allow':69C 'attack':53B 'author':5A,29B,61C 'bypass':39B 'check':6A,30B,59B 'configur':72C 'control':36B,74C 'cve':10A,13A 'exact':49B 'exploit':70C 'function':33B 'incorrect':71C 'issu':77C 'lack':27B 'level':43B 'levels.this':76C 'misconfigur':41B 'miss':4A,60C 'n/a':83C 'packag':16B 'past':57B 'payment':17B 'plugin':3A,26B 'say':48B 'secur':75C 'sourc':45B 'take':55B 'version':8A 'vulner':62C 'woocommerc':1A,18B,24B,67C,81C 'wordpress':19B 'yookassa':2A,20B,25B,68C 'yoomoney':64C 'для':23B,66C,80C 'юkassa':22B,65C,79C","nicknames":[],"mitigations":[],"who_affected":"WooCommerce stores that run the ЮKassa для WooCommerce (yookassa) plugin at version 2.17.3 or earlier are affected. The sources do not describe the exact configuration that makes access control exploitable, so sites that run the plugin with default settings should still check. Stores that do not use this payment plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114699","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114699","severity":null,"published_at":"2026-10-22T09:17:15+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114699","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114699","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}