CVE-2026-114699 in Yookassa Plugin
Summary
by MITRE • 10/22/2026
Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified security flaw represents a critical failure in access control mechanisms within the YooMoney (formerly known as YuKassa) plugin for WordPress, specifically affecting versions ranging from initial releases up to version 2.17.3. This vulnerability is classified under CWE-862, which denotes Missing Authorization, indicating that the application fails to properly verify whether an authenticated user has the necessary permissions to perform a specific action or access certain resources. In the context of e-commerce platforms powered by WooCommerce, such failures can have severe consequences as they often involve sensitive financial data and transaction processing logic. The core technical issue lies in the improper configuration of security levels for API endpoints or administrative functions exposed by the plugin, allowing attackers who possess valid credentials to execute operations beyond their intended privilege scope.
From a technical perspective, this vulnerability typically manifests when the backend logic does not adequately validate user roles against requested actions before processing them. For instance, an attacker with low-privilege accounts such as subscribers or customers might be able to invoke administrative functions that are supposed to be restricted to shop managers or administrators. This could involve modifying payment gateway settings, accessing transaction logs, manipulating order statuses without proper authorization checks, or potentially altering configuration parameters related to the YooMoney integration. The absence of robust server-side validation means that client-side restrictions can be easily bypassed using standard web request manipulation tools like Burp Suite or OWASP ZAP, allowing unauthorized entities to interact with sensitive system components directly through HTTP requests.
The operational impact of this vulnerability is significant for businesses relying on the YooMoney payment gateway integrated via WooCommerce. Successful exploitation could lead to data leakage regarding customer transactions and financial details if attackers can access restricted administrative panels or API endpoints that expose such information. Furthermore, it enables potential manipulation of order processing workflows, which may result in fraudulent activities where unauthorized users alter transaction states to reflect completed payments for unpaid orders or vice versa. This undermines the integrity of the e-commerce platform’s financial records and trustworthiness. Additionally, if the vulnerability allows privilege escalation, attackers could gain full control over the WordPress installation by exploiting administrative capabilities such as installing malicious plugins, modifying theme files, or executing arbitrary code through other linked vulnerabilities that require admin privileges to trigger.
This type of access control failure aligns with several techniques documented in the MITRE ATT&CK framework for enterprise environments and web applications. Specifically, it relates to T1078 Valid Accounts, where attackers leverage legitimate credentials to bypass authentication mechanisms by exploiting insufficient authorization checks. It also intersects with T1546 Event Triggered Execution if the vulnerability allows triggering specific system events or scripts through unauthorized administrative actions. The lack of proper role-based access control enforcement is a common root cause in many web application breaches, highlighting the need for strict adherence to security best practices during plugin development and integration.
To mitigate this risk, immediate action should be taken by updating the YooMoney для WooCommerce plugin to version 2.17.4 or any subsequent release where these authorization checks have been corrected. Developers must ensure that all administrative endpoints enforce rigorous role verification before processing requests, utilizing WordPress capabilities such as current_user_can() with appropriate capability strings rather than relying solely on user roles which can sometimes be ambiguous or misconfigured. Implementing principle of least privilege is essential, ensuring that each user account has only the permissions necessary for their specific function within the system. Regular security audits and penetration testing focused on access control flaws should also be conducted to identify similar weaknesses in other plugins or custom code integrated into the WooCommerce environment. Monitoring logs for unusual administrative activity can further aid in detecting potential exploitation attempts before significant damage occurs, thereby maintaining the overall security posture of the e-commerce infrastructure.