CVE-2026-111409

MediumCVSS 5.3

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Summary

The YITH PayPal Express Checkout for WooCommerce plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.61.0.

Risk Assessment

An unauthenticated user may perform actions they are not authorized to perform, potentially leading to unauthorized changes in store configuration or data access.

Recommendation

Update the YITH PayPal Express Checkout for WooCommerce plugin to the latest version that fixes this vulnerability.

Other vulnerabilities in YITH PayPal Express Checkout for WooCommerce

CVE-2026-27401Medium
The YITH PayPal Express Checkout for WooCommerce plugin is vulnerable to Missing Authorization due to incorrectly configured access control security levels. The issue affects versions from n/a through 1.62.0.

Original NVD description (English source)

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS