CVE-2026-73399

The CVE-2026-73399 disclosure reveals an unauthenticated REST endpoint in the Flutterwave WooCommerce plugin (versions 3.3.0 and below), and the CVSS 6.5 rating badly understates the actual risk. This is an authentication bypass in a payment processing plugin — every internet-connected user already sits inside the trust boundary. The endpoint accepts requests without any capability check, permission callback, or nonce validation, meaning transaction data, cardholder PII, and customer records were accessible to anyone who found the route. What makes this more than a one-off coding error is the structural pattern. WooCommerce plugin developers routinely extend WordPress REST endpoints while operating under a hidden assumption: 'WordPress handles auth, I just handle the business logic.' This assumption fails because WooCommerce's hooks create authentication complexity that trips up developers who aren't security specialists. The Flutterwave team likely believed WooCommerce's session or token validation protected their endpoints. It didn't. The real problem isn't this specific endpoint — it's the invisible API surface that payment plugin developers systematically under-invest in. Developers harden the checkout flow users see because that's where customer complaints arrive. REST endpoints and webhook handlers only attackers probe, so they receive less security attention even though they touch the same high-value data. This incentive asymmetry means the next unauthenticated payment endpoint in another WooCommerce plugin isn't a question of if — it's a question of which developer inherited the same flawed auth assumption. For defenders: audit every REST callback in your WooCommerce payment plugins. Explicitly verify that each endpoint has a working `permission_callback` that enforces capability checks — don't assume WooCommerce or WordPress provides this by default. Scan for deactivated but installed payment plugins from providers you've migrated away from; those abandoned installations carry the same vulnerability with zero chance of ever receiving a patch. The blast radius here is severe — an unauthenticated payment endpoint is the functional equivalent of leaving the vault door open and trusting the building's security guard.

Reviewed through automated stages and approved by a human before publication.