CVE-2026-15230 — YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure

CVE-2026-15230

YayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code Disclosure PUBLISHED

Description (CNA)

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes.

Affected (CNA)

Vendor / product	Versions
Unknown / YayPricing	affected 0 before 3.5.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c2346f90-130c-45da-92ca-31acaa2f4605/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.