CVE-2026-65457

MediumCVSS 4.3

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The ЮKassa for WooCommerce plugin version 2.16.1 and earlier contains a Broken Access Control vulnerability exploitable by a subscriber. A subscriber can gain unauthorized access to administrative functions.

Risk Assessment

An attacker can change plugin settings, including payment configuration, potentially leading to theft of funds.

Recommendation

Update the ЮKassa for WooCommerce plugin to the latest version and implement proper access controls.

Other vulnerabilities in ЮKassa dla WooCommerce

CVE-2026-65434Medium
The ЮKassa for WooCommerce plugin version 2.16.1 and earlier allows Subscriber-level users to access sensitive data. The vulnerability involves unauthorized data exposure.

Original NVD description (English source)

Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS