CVE-2026-27378

MediumCVSS 5.3

Published: 11/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

The Deposits and Partial Payments for WooCommerce plugin in versions up to and including 3.1.0 contains a Broken Access Control vulnerability accessible to unauthenticated users. A person without login can bypass access control mechanisms.

Risk Assessment

Any internet user may gain access to functions or data reserved for authorized individuals, potentially leading to unauthorized financial operations or data leakage.

Recommendation

Update the Deposits and Partial Payments for WooCommerce plugin to a version newer than 3.1.0 once a fix is available and consider temporarily disabling the plugin.

Other vulnerabilities in Deposits and Partial Payments for WooCommerce

CVE-2026-95589Medium
The Magepeople inc. Deposits and Partial Payments for WooCommerce (advanced-partial-payment-or-deposit-for-woocommerce) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.0.1.

Original NVD description (English source)

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS