CVE-2026-95589

MediumCVSS 6.5

Published: 09/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The Magepeople inc. Deposits and Partial Payments for WooCommerce (advanced-partial-payment-or-deposit-for-woocommerce) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.0.1.

Risk Assessment

An unauthenticated or low-privileged user could perform actions they should not be allowed to, potentially leading to unauthorized access to plugin functionality.

Recommendation

Update Deposits and Partial Payments for WooCommerce to a version later than 4.0.1 or apply available mitigations, and review WordPress role permissions.

Other vulnerabilities in Deposits and Partial Payments for WooCommerce

CVE-2026-27378Medium
The Deposits and Partial Payments for WooCommerce plugin in versions up to and including 3.1.0 contains a Broken Access Control vulnerability accessible to unauthenticated users. A person without login can bypass access control mechanisms.

Original NVD description (English source)

Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS