CVE-2026-73399

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Summary

The Flutterwave WooCommerce plugin version 3.3.0 and earlier has a broken authentication vulnerability that does not require authentication. This means an unauthenticated attacker can gain unauthorized access to functions or data.

Risk Assessment

The risk is that an attacker without logging in can access sensitive functions or data, potentially leading to confidentiality and integrity breaches.

Recommendation

It is recommended to update the plugin to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.