{"id":"CVE-2026-121571","kind":"vulnerability","aliases":["CVE-2026-121571"],"related":[],"title":"WordPress WooCommerce Autopay plugin: missing authorization check exposes payments","description":"Missing Authorization vulnerability in WP Desk Autopay dla WooCommerce pay-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autopay dla WooCommerce: from n/a through 2.3.0.","summary":"Autopay dla WooCommerce, a WordPress payment plugin from WP Desk, has a missing authorization check in its pay-wp component. The sources say an attacker can exploit incorrectly configured access control levels, but do not state the exact action an attacker gets.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["autopay","package","woocommerce","wordpress","wp-desk"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Autopay dla WooCommerce plugin version in the WordPress admin under Plugins.\n- Look for the plugin slug `pay-wp` in the plugins directory.\n- Confirm whether the installed version is `2.3.0` or earlier.","fix":"- Autopay dla WooCommerce: a fixed version is unknown; the sources only say the issue affects versions through `2.3.0`.","status":"open","published_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","triaged_at":"2026-11-07T11:48:27+00:00","updated_at":"2026-11-07T11:48:27+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-07T11:48:27Z","model":"claude-haiku-5-5","output":{"fix":"- Autopay dla WooCommerce: a fixed version is unknown; the sources only say the issue affects versions through `2.3.0`.","reach":"internet","title":"WordPress WooCommerce Autopay plugin: missing authorization check exposes payments","impact":"medium","summary":"Autopay dla WooCommerce, a WordPress payment plugin from WP Desk, has a missing authorization check in its pay-wp component. The sources say an attacker can exploit incorrectly configured access control levels, but do not state the exact action an attacker gets.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","autopay","wp-desk"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; access control on payment functions may be bypassed","analyst_note":"Find the vendor advisory or Wordfence/NVD detail for CVE-2026-121571 to confirm the affected function, required privilege, and fixed version.","how_to_check":"- Check the installed Autopay dla WooCommerce plugin version in the WordPress admin under Plugins.\n- Look for the plugin slug `pay-wp` in the plugins directory.\n- Confirm whether the installed version is `2.3.0` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Autopay dla WooCommerce WordPress plugin version 2.3.0 or earlier are in scope according to the advisory's affected range. Sites that do not use this plugin are not affected. The sources do not describe the exact exposure path or required role.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000733,"input_tokens":4228,"output_tokens":621,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121571':12A,15A '-2026':11A,14A '2.3.0':94C 'access':53B,82C 'action':62B 'affect':87C 'allow':78C 'attack':48B,64B 'author':6A,36B,67C 'autopay':3A,16B,23B,72C,88C 'check':7A,37B 'compon':43B 'configur':52B,81C 'control':54B,83C 'cve':10A,13A 'desk':22B,32B,71C 'dla':24B,73C,89C 'exact':61B 'exploit':50B,79C 'expos':8A 'get':65B 'incorrect':51B,80C 'issu':86C 'level':55B 'levels.this':85C 'miss':5A,35B,66C 'n/a':92C 'packag':17B 'pay':41B,76C 'pay-wp':40B,75C 'payment':9A,28B 'plugin':4A,29B 'say':46B 'secur':84C 'sourc':45B 'state':59B 'vulner':68C 'woocommerc':2A,18B,25B,74C,90C 'wordpress':1A,19B,27B 'wp':21B,31B,42B,70C,77C 'wp-desk':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Autopay dla WooCommerce WordPress plugin version 2.3.0 or earlier are in scope according to the advisory's affected range. Sites that do not use this plugin are not affected. The sources do not describe the exact exposure path or required role.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["autopay","medium","package","woocommerce","wordpress","wpdesk"],"campaign_type":null,"search_a":"'-121571':12A,15A '-2026':11A,14A 'author':6A 'autopay':3A 'check':7A 'cve':10A,13A 'expos':8A 'miss':5A 'payment':9A 'plugin':4A 'woocommerc':2A 'wordpress':1A","search_b":"'access':53B 'action':62B 'attack':48B,64B 'author':36B 'autopay':16B,23B 'check':37B 'compon':43B 'configur':52B 'control':54B 'desk':22B,32B 'dla':24B 'exact':61B 'exploit':50B 'get':65B 'incorrect':51B 'level':55B 'miss':35B 'packag':17B 'pay':41B 'pay-wp':40B 'payment':28B 'plugin':29B 'say':46B 'sourc':45B 'state':59B 'woocommerc':18B,25B 'wordpress':19B,27B 'wp':21B,31B,42B 'wp-desk':20B","search_c":"'2.3.0':94C 'access':82C 'affect':87C 'allow':78C 'author':67C 'autopay':72C,88C 'configur':81C 'control':83C 'desk':71C 'dla':73C,89C 'exploit':79C 'incorrect':80C 'issu':86C 'levels.this':85C 'miss':66C 'n/a':92C 'pay':76C 'pay-wp':75C 'secur':84C 'vulner':68C 'woocommerc':74C,90C 'wp':70C,77C","first_public_at":"2026-11-07T11:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121571","severity":null,"published_at":"2026-11-07T11:17:00+00:00","modified_at":"2026-11-07T11:17:00+00:00","first_seen_at":"2026-11-07T11:46:53+00:00","fetched_at":"2026-11-07T11:46:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}