CVE-2026-65434

This vulnerability in a ЮKassa (Russian payment processor) WooCommerce plugin exposes subscriber transaction data to unauthorized users—CVSS 6.5, but the score undersells the risk. Subscriber-level access to transaction history is reconnaissance for account takeover and targeted fraud, not just privacy exposure. If you're running any WooCommerce payment plugin, check this immediately. What to do: First, audit whether subscriber-role users in your store can view transaction data they shouldn't access—order histories, payment details, or customer PII. Second, review the plugin's debug and logging settings; this vulnerability class often stems from verbose logging that writes transaction context to files or screens accessible below the admin level. Third, check if your payment plugins expose admin-facing data paths to lower-privileged roles—this is a recurring failure mode in WooCommerce payment extensions, not an isolated bug. The deeper pattern: This is the fourth documented instance of subscriber-data exposure through WooCommerce payment plugin hook callbacks over the past decade (2014-2016, 2018-2019, now). The root cause isn't developer incompetence—it's the economic condition of plugin development: feature sprints under deadline pressure produce code that implicitly trusts WordPress's role system without verifying the specific data path respects those roles. The fix is usually a single capability check, but the pattern keeps reproducing because the developer who writes the next payment plugin has never seen CVE-2015-xxxx or CVE-2019-xxxx documenting their predecessor's identical mistake. The geographic context compounds this. Russian payment processor plugins face elevated abandonment risk from geopolitical disruption. If the developer loses API access or faces sanctions, the plugin becomes orphaned code still running on production stores—with the access control flaw intact and no fix coming. The CVSS score measures the vulnerability, not the remediation gap. For this population, that gap may be existential. Prioritize patching, audit your other payment plugins for the same access control pattern, and treat any payment extension that underwent a feature sprint in the past 6-12 months as higher-risk for similar implicit trust failures.

Reviewed through automated stages and approved by a human before publication.