CVE-2026-66442

MediumCVSS 5.4

Published: 27/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

The YayPricing plugin up to version 3.5.6 has a Broken Access Control vulnerability exploitable by a subscriber. This allows unauthorized access to functions or data.

Risk Assessment

A subscriber can access sensitive data or perform operations reserved for the administrator.

Recommendation

Update the YayPricing plugin to the latest version that fixes the access control issue.

Other vulnerabilities in YayPricing

CVE-2026-87888High
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules. This allows users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing settings page.

Original NVD description (English source)

Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS