{"id":"CVE-2026-106609","published":"2026-10-10T17:17:00.310","lastModified":"2026-10-13T13:28:15.717","description":"Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/bayarcash-wc/vulnerability/wordpress-bayarcash-woocommerce-plugin-4-4-2-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to bypass authorization controls in the Bayarcash WooCommerce plugin, enabling them to perform actions they shouldn't be able to access. The flaw occurs due to incorrectly configured access control security levels.","exploitability":"Exploitation is relatively straightforward with no special preconditions required, as the vulnerability affects unauthenticated users and allows for unauthorized modifications.","blast_radius":"If exploited, attackers could modify payment configurations or transaction data in the WooCommerce store, potentially leading to financial discrepancies or unauthorized access to payment processing features.","remediation":"Upgrade to version 4.4.3 or later to address the missing authorization vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authorization","woocommerce","e-commerce"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:11:24.316Z"}}