---
id: "CVE-2026-114699"
kind: "vulnerability"
aliases: ["CVE-2026-114699"]
title: "WooCommerce YooKassa plugin: missing authorization check through version 2.17.3"
severity: "medium"
cvss: 5.3
epss: 0.00187
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "payments", "woocommerce", "wordpress", "yookassa"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-22T09:17:15+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114699", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114699", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# WooCommerce YooKassa plugin: missing authorization check through version 2.17.3

The ЮKassa для WooCommerce (yookassa) plugin lacks an authorization check on some functionality, so access control can be bypassed through misconfigured access levels. The sources do not say exactly which action an attacker can take once past the check.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/yookassa/` header of the main plugin file
- Confirm whether the installed version is `2.17.3` or earlier, which the sources name as affected

## Fix

- Update the ЮKassa для WooCommerce (yookassa) plugin to a version later than `2.17.3`; the exact fixed version is unknown from the sources

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114699
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114699

## From the sources

Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_