EUVD-2026-53116

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes...

WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by K. Sorrachat in WordPress Plugin YayPricing versions = 3.5.6...