---
id: "CVE-2026-27401"
kind: "vulnerability"
aliases: ["CVE-2026-27401"]
title: "YITH PayPal Express Checkout for WooCommerce: missing access check on a WordPress plugin"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "paypal", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-29T12:17:12+00:00"
first_seen_at: "2026-10-29T12:24:38+00:00"
updated_at: "2026-10-29T12:25:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27401", "first_seen_at": "2026-10-29T12:24:38+00:00"}]
---

# YITH PayPal Express Checkout for WooCommerce: missing access check on a WordPress plugin

The YITH PayPal Express Checkout plugin for WooCommerce lacks an authorization check on some functionality, so access control is not enforced as intended. The sources do not say which action an attacker can reach or what data or change results.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `yith-paypal-express-checkout-for-woocommerce` plugin is installed and its version in the WordPress plugins screen
- Compare the installed version against `1.62.0`, the last version the sources list as affected

## Fix

- Move to a version newer than `1.62.0` (the sources say affected versions run through `1.62.0`; the fixed version is not stated)

## Timeline

- 2026-10-29T12:24:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-27401

## From the sources

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_