CVE-2026-16058

MediumCVSS 5.3

Published: 19/08/2026(UTC)Updated: 22/10/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.

Risk Assessment

Exposure of financial data of the store and vendors can lead to confidentiality breaches and potential fraud.

Recommendation

Update the YayCurrency plugin to version 3.3.5 or later, which includes security fixes.

Other vulnerabilities in YayCurrency

CVE-2025-60114Medium
The YayCurrency plugin for WordPress (versions up to and including 3.3.1) contains a Code Injection vulnerability caused by improper control of code generation. An attacker can inject and execute arbitrary code within the application context.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS