CVE-2026-121571

MediumCVSS 5.3

Published: 07/11/2026(UTC)Updated: 07/11/2026(UTC)Translated: 07/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Autopay dla WooCommerce plugin through version 2.3.0 contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 2.3.0.

Risk Assessment

An unauthorized user may gain access to payment functions or order data, potentially leading to abuse. The risk affects WooCommerce stores using this plugin.

Recommendation

Update the Autopay dla WooCommerce plugin to a version later than 2.3.0. Review permission and access configuration for payment functions.

Other vulnerabilities in Autopay dla WooCommerce

CVE-2026-57425Medium
Autopay dla WooCommerce plugin version 2.2.27 and earlier has a broken access control vulnerability without authentication. An unauthenticated attacker can gain unauthorized access.

Original NVD description (English source)

Missing Authorization vulnerability in WP Desk Autopay dla WooCommerce pay-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autopay dla WooCommerce: from n/a through 2.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS