CVE-2026-108492

MediumCVSS 5.3

Published: 13/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments allows exploiting incorrectly configured access control security levels. This issue affects Quick Paypal Payments from n/a through 6.0.3.

Risk Assessment

Unauthorized users may gain access to PayPal payment settings, potentially leading to unauthorized transactions or data compromise.

Recommendation

Update Quick Paypal Payments to the latest patched version. Verify access permissions.

Other vulnerabilities in Quick Paypal Payments

CVE-2026-17008Medium
The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid.

Original NVD description (English source)

Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS