Live › vulnerability › CVE-2026-27401
The YITH PayPal Express Checkout plugin for WooCommerce lacks an authorization check on some functionality, so access control is not enforced as intended. The sources do not say which action an attacker can reach or what data or change results.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 12:24 UTC. All times on this page are UTC.
Sites running the YITH PayPal Express Checkout for WooCommerce plugin at version 1.62.0 or earlier are in scope according to the sources. Stores that do not have this plugin installed are not affected. Whether an unauthenticated visitor can reach the flaw is unknown.
No product ranges from the sources yet.
yith-paypal-express-checkout-for-woocommerce plugin is installed and its version in the WordPress plugins screen1.62.0, the last version the sources list as affected1.62.0 (the sources say affected versions run through 1.62.0; the fixed version is not stated)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-27401")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.