Live › vulnerability › CVE-2026-76058
Go to dashboardThe PayPal Brasil para WooCommerce WordPress plugin, up to and including 1.7.8, does not check authorization on an action. An unauthenticated attacker can enable or disable the PayPal BCDC gateway and overwrite its WooCommerce settings, removing PayPal from checkout for all customers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running the PayPal Brasil para WooCommerce plugin at version 1.7.8 or earlier on WordPress with WooCommerce, where the PayPal BCDC gateway is in use. The flaw is reachable without logging in, so any public WooCommerce store with the plugin installed is exposed. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp plugin get <plugin-slug> using WP-CLI1.7.8 once the vendor ships a fix; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disable or enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings, removing PayPal from checkout for all customers.
This page as .md · .json · in your agent: get_signal("CVE-2026-76058")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.