CVE-2026-15230
HIGHYayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure
Title source: cnaDescription
The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes.
References (1)
Core 1
Core References
Exploit exploit
vdb-entry
technical-description
https://wpscan.com/vulnerability/c2346f90-130c-45da-92ca-31acaa2f4605/
Scores
CVSS v3
8.1
EPSS
0.0025
EPSS Percentile
16.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-284
Status
published
Products (1)
None/YayPricing
< 3.5.7
Published
Aug 05, 2026
Tracked Since
Aug 05, 2026