Skip to content
Sign in
8.1 High

CVE-2026-15230 The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes,…

Description

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes.

Affected products and versions

Product Affected versions Fixed in
YayPricing 3.5 earliest → < 3.5.7 3.5.7

Other CVEs of YayPricing

The 2 CVEs of YayPricing →
CVE-2026-87888 The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its… 8.0 High
Track this CVE