CVE-2026-24606

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24606", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:32:17.047Z", "datePublished": "2026-01-23T14:29:04.107Z", "dateUpdated": "2026-04-28T16:14:50.315Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "bayarcash-wc", "product": "Bayarcash WooCommerce", "vendor": "Web Impian", "versions": [{"changes": [{"at": "4.3.14", "status": "unaffected"}], "lessThanOrEqual": "4.3.13", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:50.365Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13.</p>"}], "value": "Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:50.315Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/bayarcash-wc/vulnerability/wordpress-bayarcash-woocommerce-plugin-4-3-11-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Bayarcash WooCommerce plugin <= 4.3.13 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T20:08:20.539092Z", "id": "CVE-2026-24606", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:37:24.966Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24606", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T20:08:20.539092Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:08:09.652Z"}}], "cna": {"title": "WordPress Bayarcash WooCommerce plugin <= 4.3.13 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Md. Moniruzzaman Prodhan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Web Impian", "product": "Bayarcash WooCommerce", "versions": [{"status": "affected", "changes": [{"at": "4.3.14", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "4.3.13"}], "packageName": "bayarcash-wc", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:50.365Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/bayarcash-wc/vulnerability/wordpress-bayarcash-woocommerce-plugin-4-3-11-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:06.960Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24606", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:37:24.966Z", "dateReserved": "2026-01-23T12:32:17.047Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:29:04.107Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "bayarcash-wc", "product": "Bayarcash WooCommerce", "vendor": "Web Impian", "versions": [{"changes": [{"at": "4.3.14", "status": "unaffected"}], "lessThanOrEqual": "4.3.13", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en Web Impian Bayarcash WooCommerce bayarcash-wc permite la explotaci\u00f3n de niveles de seguridad de control de acceso mal configurados. Este problema afecta a Bayarcash WooCommerce: desde n/a hasta &lt;= 4.3.11."}], "id": "CVE-2026-24606", "lastModified": "2026-06-17T10:23:18.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24606", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T20:08:20.539092Z", "version": "2.0.3"}}]}, "published": "2026-01-23T15:16:19.407", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/bayarcash-wc/vulnerability/wordpress-bayarcash-woocommerce-plugin-4-3-11-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T01:33:00.374909+00:00", "value": {"mitigation_remediation": ["Upgrade Bayarcash WooCommerce to version 4.3.14 or later when it becomes available.", "Restrict the assignment of elevated user roles that can access WooCommerce settings, ensuring only trusted administrators can manage plugin configurations.", "If a patch is not yet released, disable the Bayarcash WooCommerce plugin to eliminate the exposed access controls until the vendor issues an update."], "summary": {"action": "Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "Affected product is the Bayarcash WooCommerce plugin, distributed by Web Impian. All releases from the first version through 4.3.13 are impacted; newer releases are not affected.", "description_and_impact": "The WordPress Bayarcash WooCommerce plugin has a missing authorization flaw that allows attackers to bypass correctly configured access control settings. This defect aligns with CWE\u2011862 and permits exploitation of protected resources without proper authentication. If an attacker can reach the vulnerable components, they may view, modify, or delete sensitive data, potentially exposing user information or disrupting e\u2011commerce operations.", "risk_and_exploitability": "The CVSS base score is 5.3, indicating moderate severity. The EPSS score is under 1%, suggesting a low but non\u2011zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based solely on the description, the most likely attack vector is through the web interface of a site running the plugin, where an attacker could craft requests that bypass role checks. No additional prerequisites such as elevated privileges or network access are mentioned, so a remote attacker with internet access to the site could potentially exploit the flaw."}}}}, "created": "2026-01-26T11:53:30.731008+00:00", "updated": "2026-04-16T01:45:20.648498+00:00", "vendors": ["web_impian", "web_impian$PRODUCT$bayarcash_woo_commerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}