{"id":"CVE-2026-76058","kind":"vulnerability","aliases":["CVE-2026-76058"],"related":[],"title":"PayPal Brasil for WooCommerce: unauthenticated users can change payment gateway settings","description":"The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disable or enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings, removing PayPal from checkout for all customers.","summary":"The PayPal Brasil para WooCommerce WordPress plugin, up to and including 1.7.8, does not check authorization on an action. An unauthenticated attacker can enable or disable the PayPal BCDC gateway and overwrite its WooCommerce settings, removing PayPal from checkout for all customers.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","payment-gateway","paypal","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug>` using WP-CLI\n- Look for the plugin's gateway in WooCommerce > Settings > Payments to see whether it was changed unexpectedly","fix":"- Update PayPal Brasil para WooCommerce to a version later than `1.7.8` once the vendor ships a fix; the sources do not name the fixed version\n- Until a fixed version is installed, deactivate the plugin or restrict access to the site's payment settings at the web server level","status":"open","published_at":"2026-10-28T07:16:48+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","triaged_at":"2026-10-28T07:33:21+00:00","updated_at":"2026-10-28T07:33:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T07:33:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update PayPal Brasil para WooCommerce to a version later than `1.7.8` once the vendor ships a fix; the sources do not name the fixed version\n- Until a fixed version is installed, deactivate the plugin or restrict access to the site's payment settings at the web server level","reach":"internet","title":"PayPal Brasil for WooCommerce: unauthenticated users can change payment gateway settings","impact":"medium","summary":"The PayPal Brasil para WooCommerce WordPress plugin, up to and including 1.7.8, does not check authorization on an action. An unauthenticated attacker can enable or disable the PayPal BCDC gateway and overwrite its WooCommerce settings, removing PayPal from checkout for all customers.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","paypal","payment-gateway"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker disables PayPal checkout and overwrites gateway settings","analyst_note":"Confirm the fixed plugin version and the specific vulnerable endpoint from the NVD entry or the vendor's changelog; the sources do not give either.","how_to_check":"- Check the installed version of the plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug>` using WP-CLI\n- Look for the plugin's gateway in WooCommerce > Settings > Payments to see whether it was changed unexpectedly","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the PayPal Brasil para WooCommerce plugin at version 1.7.8 or earlier on WordPress with WooCommerce, where the PayPal BCDC gateway is in use. The flaw is reachable without logging in, so any public WooCommerce store with the plugin installed is exposed. Sites without this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000689,"input_tokens":3379,"output_tokens":703,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-76058':14A,17A '1.7.8':36B,87C 'action':43B,105C 'attack':46B,112C 'author':40B,78C,101C 'bcdc':53B,120C 'brasil':2A,27B,69C,119C 'bypass':79C 'chang':8A 'check':39B 'checkout':63B,132C 'custom':66B,135C 'cve':12A,15A 'disabl':50B,114C 'due':90C 'enabl':48B,116C 'gateway':10A,21B,54B,122C,127C 'includ':35B,86C 'make':107C 'overwrit':56B,124C 'packag':18B 'para':28B,70C 'payment':9A,20B,121C 'payment-gateway':19B 'paypal':1A,22B,26B,52B,61B,68C,118C,130C 'perform':103C 'plugin':31B,72C,93C 'possibl':109C 'proper':95C 'remov':60B,129C 'set':11A,59B,128C 'unauthent':5A,45B,111C 'user':6A,99C 'verifi':96C 'version':82C 'vulner':76C 'woocommerc':4A,23B,29B,58B,71C,126C 'wordpress':24B,30B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the PayPal Brasil para WooCommerce plugin at version 1.7.8 or earlier on WordPress with WooCommerce, where the PayPal BCDC gateway is in use. The flaw is reachable without logging in, so any public WooCommerce store with the plugin installed is exposed. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76058","severity":null,"published_at":"2026-10-28T07:16:48+00:00","modified_at":"2026-10-28T07:16:48+00:00","first_seen_at":"2026-10-28T07:31:38+00:00","fetched_at":"2026-10-28T07:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}