6.5 Medium

CVE-2026-1710 The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data…

Description

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_upe_appearance_ajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to update plugin settings.

Affected products and versions

Product	Affected versions	Fixed in
WooPayments: Integrated WooCommerce Payments 10.5	earliest → 10.5.1	No fix stated

Do you use WooPayments: Integrated WooCommerce Payments?

Track this CVE Watch WooPayments: Integrated WooCommerce Payments Check my SBOMs

www.cveye.io/en/cve/CVE-2026-1710

Timeline

Published March 31, 2026
Last modified May 12, 2026

References

www.wordfence.com www.wordfence.com
plugins.trac.wordpress.org plugins.trac.wordpress.org
plugins.trac.wordpress.org plugins.trac.wordpress.org
research.cleantalk.org research.cleantalk.org

Track this CVE