{"id":"CVE-2026-27401","kind":"vulnerability","aliases":["CVE-2026-27401"],"related":[],"title":"YITH PayPal Express Checkout for WooCommerce: missing access check on a WordPress plugin","description":"Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0.","summary":"The YITH PayPal Express Checkout plugin for WooCommerce lacks an authorization check on some functionality, so access control is not enforced as intended. The sources do not say which action an attacker can reach or what data or change results.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","paypal","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `yith-paypal-express-checkout-for-woocommerce` plugin is installed and its version in the WordPress plugins screen\n- Compare the installed version against `1.62.0`, the last version the sources list as affected","fix":"- Move to a version newer than `1.62.0` (the sources say affected versions run through `1.62.0`; the fixed version is not stated)","status":"open","published_at":"2026-10-29T12:17:12+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","triaged_at":"2026-10-29T12:25:39+00:00","updated_at":"2026-10-29T12:25:39+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T12:25:39Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version newer than `1.62.0` (the sources say affected versions run through `1.62.0`; the fixed version is not stated)","reach":"unknown","title":"YITH PayPal Express Checkout for WooCommerce: missing access check on a WordPress plugin","impact":"medium","summary":"The YITH PayPal Express Checkout plugin for WooCommerce lacks an authorization check on some functionality, so access control is not enforced as intended. The sources do not say which action an attacker can reach or what data or change results.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","paypal"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to checkout or store actions; exact impact not stated","analyst_note":"Check the NVD entry and the WordPress plugin changelog for the fixed version and the exact unauthorized action.","how_to_check":"- Check whether the `yith-paypal-express-checkout-for-woocommerce` plugin is installed and its version in the WordPress plugins screen\n- Compare the installed version against `1.62.0`, the last version the sources list as affected","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the YITH PayPal Express Checkout for WooCommerce plugin at version 1.62.0 or earlier are in scope according to the sources. Stores that do not have this plugin installed are not affected. Whether an unauthenticated visitor can reach the flaw is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4145,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-27401':16A,19A '1.62.0':101C 'access':8A,40B,86C 'action':53B 'affect':91C 'allow':82C 'attack':55B 'author':34B,65C 'chang':62B 'check':9A,35B 'checkout':4A,28B,72C,79C,95C 'configur':85C 'control':41B,87C 'cve':14A,17A 'data':60B 'enforc':44B 'exploit':83C 'express':3A,27B,71C,78C,94C 'function':38B 'incorrect':84C 'intend':46B 'issu':90C 'lack':32B 'levels.this':89C 'miss':7A,64C 'n/a':99C 'packag':20B 'paypal':2A,21B,26B,70C,77C,93C 'plugin':13A,29B 'reach':57B 'result':63B 'say':51B 'secur':88C 'sourc':48B 'vulner':66C 'woocommerc':6A,22B,31B,74C,81C,97C 'wordpress':12A,23B 'yith':1A,25B,68C,69C,76C,92C 'yith-paypal-express-checkout-for-woocommerc':75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the YITH PayPal Express Checkout for WooCommerce plugin at version 1.62.0 or earlier are in scope according to the sources. Stores that do not have this plugin installed are not affected. Whether an unauthenticated visitor can reach the flaw is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T12:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-27401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27401","severity":null,"published_at":"2026-10-29T12:17:12+00:00","modified_at":"2026-10-29T12:17:12+00:00","first_seen_at":"2026-10-29T12:24:38+00:00","fetched_at":"2026-10-29T12:24:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}