CVE-2026-16058 YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and...

CVE-2026-16058

The YayCurrency WordPress plugin (versions before 3.3.5 ) contains an authorization bypass vulnerability in its multi-vendor integration handlers, specifically related to the Dokan integration. The root cause is a failure to perform necessary capability or ownership checks , allowing unauthentica...