CVE-2026-66461

CVE-2026-66461 is an unauthenticated access control failure in a WordPress WooCommerce UPI payment gateway plugin. The vulnerability carries a CVSS 7.5 rating, reflecting that an attacker can invoke admin or callback endpoints without any credentials—simply knowing the plugin exists on a target site. The EPSS score of 0.00246 indicates this isn't being actively weaponized at scale yet, but that should not create complacency. The pattern here is more important than this specific instance. This vulnerability class has appeared repeatedly in WooCommerce payment plugins since 2019-2021, and this recurrence is not coincidental. The plugin ecosystem teaches developers to implement callback endpoints by copying patterns from earlier gateway plugins, many of which contained the same access control gaps. A plugin at version 1.0.5 signals minimal lifecycle—likely built to solve one merchant's immediate problem, packaged, and then minimally maintained. The developer may have correctly implemented the payment logic but never formalized which roles or capabilities could invoke which endpoints, assuming WooCommerce's checkout flow implicitly protected the associated callbacks. It does not. For defenders: first, confirm whether this specific plugin or any similar UPI/gateway plugin is installed—check both active and inactive plugins, as abandoned plugins remain installed on many sites. Second, if such a plugin exists, verify whether the callback endpoints are protected by capability checks or nonce validation; the absence of either is the vulnerability. Third, consider that even if this specific plugin is patched, the underlying pattern persists across the ecosystem—the next gateway plugin following the same development template will produce the same flaw. The low EPSS reflects that attackers are patient and waiting for high-value targets to appear, not that the exposure is theoretical. The blast radius matters: successful exploitation means interacting with financial infrastructure—transaction records, settlement data, potentially customer payment metadata—without credentials. Prioritize remediation based on that downstream reach, not just the CVSS number.

Reviewed through automated stages and approved by a human before publication.