CVE-2026-87888 in YayPricing Plugin
Summary
by MITRE • 09/12/2026
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in YayPricing versions prior to 3.5.7 represents a critical failure in access control mechanisms within the WordPress REST API implementation. Specifically, the endpoint responsible for saving pricing rules lacks proper authorization checks, which is a fundamental security requirement for any state-changing operation involving administrative or privileged data structures. This flaw allows authenticated users with even the lowest privilege level of subscriber to interact directly with this sensitive functionality without being granted the necessary permissions by the application logic. In standard WordPress architecture, REST endpoints must verify that the requesting user possesses specific capabilities before executing actions that modify site configuration or database records. The absence of this verification step creates a direct path for unauthorized state modification, bypassing the intended role-based access control model designed to protect administrative functions from lower-privileged users.
The technical nature of this flaw is classified as an authorization bypass leading to stored cross-site scripting. By exploiting the missing check on the pricing rules endpoint, an attacker can inject malicious JavaScript payloads into the plugin's configuration data. Because WordPress typically sanitizes and escapes output in many contexts but may not adequately sanitize input for specific custom fields or database-stored settings that are later rendered without proper escaping, this stored script persists within the application state. When a user with administrative privileges accesses the YayPricing settings page to view or edit pricing configurations, the browser parses and executes the injected JavaScript code within the context of the administrator's session. This execution occurs in the trusted environment of the WordPress admin dashboard, granting the attacker full access to the DOM and potentially sensitive data accessible via client-side scripts.
The operational impact of this vulnerability is severe due to its potential for complete site compromise through stored cross-site scripting rather than transient reflected attacks. Since the malicious code is persisted on the server side within the pricing rules database entries, it does not require complex social engineering or specific trigger conditions beyond an administrator viewing a particular page. Once executed, the script can perform various hostile actions including stealing session cookies to hijack administrative sessions, scraping sensitive site data such as user lists and configuration details, performing unauthorized API requests on behalf of the admin, or defacing the website interface. This effectively elevates the attacker's privileges from subscriber to administrator level without any direct interaction with WordPress core files or database structures outside of the intended plugin endpoints.
From a standards perspective, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-79 Cross-site Scripting in its stored variant. The failure to enforce role-based permissions on a REST endpoint is a classic example of broken access control, while the injection and execution of client-side scripts constitute a significant XSS risk. In terms of threat modeling frameworks like MITRE ATT&CK, this activity maps to techniques involving web application exploitation for credential harvesting or privilege escalation, specifically leveraging stored payloads that execute upon legitimate user interaction with compromised interfaces. The persistence mechanism ensures long-term access potential if the vulnerability remains unpatched and no manual cleanup is performed by site administrators who may not be aware of the injected code hidden within plugin settings.
Mitigation strategies must prioritize immediate remediation through software updates as well as defensive configuration changes for sites unable to upgrade immediately. The primary defense is upgrading YayPricing to version 3.5.7 or later, where the developers have implemented proper authorization checks on the REST endpoint responsible for saving pricing rules. For environments running older versions, temporary mitigations include restricting access to WordPress admin pages using IP whitelisting if feasible, implementing a Web Application Firewall that can detect and block XSS payloads in POST requests targeting known vulnerable endpoints, and auditing plugin database tables for suspicious script injections. Additionally, enforcing strict Content Security Policy headers on the administrative interface can help mitigate the impact of any successfully injected scripts by restricting where JavaScript code is allowed to execute or what external resources it can contact. Regular security audits focusing on REST API endpoint permissions are recommended to prevent similar authorization bypasses in other plugins and custom development within WordPress ecosystems.