CVE-2026-65434

MediumCVSS 6.5

Published: 27/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

The ЮKassa for WooCommerce plugin version 2.16.1 and earlier allows Subscriber-level users to access sensitive data. The vulnerability involves unauthorized data exposure.

Risk Assessment

The risk involves potential leakage of sensitive data by low-privilege users, which could compromise the confidentiality of customer or system information.

Recommendation

Update the ЮKassa for WooCommerce plugin to a version later than 2.16.1 that fixes this vulnerability.

Other vulnerabilities in ЮKassa dla WooCommerce

CVE-2026-65457Medium
The ЮKassa for WooCommerce plugin version 2.16.1 and earlier contains a Broken Access Control vulnerability exploitable by a subscriber. A subscriber can gain unauthorized access to administrative functions.

Original NVD description (English source)

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS