---
id: "CVE-2026-76058"
kind: "vulnerability"
aliases: ["CVE-2026-76058"]
title: "PayPal Brasil for WooCommerce: unauthenticated users can change payment gateway settings"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "payment-gateway", "paypal", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-28T07:16:48+00:00"
first_seen_at: "2026-10-28T07:31:38+00:00"
updated_at: "2026-10-28T07:33:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76058", "first_seen_at": "2026-10-28T07:31:38+00:00"}]
---

# PayPal Brasil for WooCommerce: unauthenticated users can change payment gateway settings

The PayPal Brasil para WooCommerce WordPress plugin, up to and including 1.7.8, does not check authorization on an action. An unauthenticated attacker can enable or disable the PayPal BCDC gateway and overwrite its WooCommerce settings, removing PayPal from checkout for all customers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the plugin in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug>` using WP-CLI
- Look for the plugin's gateway in WooCommerce > Settings > Payments to see whether it was changed unexpectedly

## Fix

- Update PayPal Brasil para WooCommerce to a version later than `1.7.8` once the vendor ships a fix; the sources do not name the fixed version
- Until a fixed version is installed, deactivate the plugin or restrict access to the site's payment settings at the web server level

## Timeline

- 2026-10-28T07:31:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76058

## From the sources

The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disable or enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings, removing PayPal from checkout for all customers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_