CVE-2026-27401

MediumCVSS 5.3

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Summary

The YITH PayPal Express Checkout for WooCommerce plugin is vulnerable to Missing Authorization due to incorrectly configured access control security levels. The issue affects versions from n/a through 1.62.0.

Risk Assessment

An attacker could exploit misconfigured access control levels to perform unauthorized operations in the WooCommerce store. This may lead to unauthorized access to functionality or payment data.

Recommendation

Update YITH PayPal Express Checkout for WooCommerce to a version later than 1.62.0 and review the store's permission configuration.

Other vulnerabilities in YITH PayPal Express Checkout for WooCommerce

CVE-2026-111409Medium
The YITH PayPal Express Checkout for WooCommerce plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.61.0.

Original NVD description (English source)

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS