Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

YITH PayPal Express Checkout for WooCommerce lets anyone change settings

CVE-2026-27401 · published 6 days ago
Summary

The YITH PayPal Express Checkout for WooCommerce plugin (versions up to 1.62.0) does not properly verify who is allowed to use its functions. Because of this, an unauthenticated user could modify the plugin’s configuration or view sensitive checkout information. Install the latest version of the plugin or apply the vendor’s patch to secure the site.

What to do
  • Update yith yith paypal express checkout for woocommerce to version 1.62.1.
Affected software
VendorProductAffected versions
yith yith paypal express checkout for woocommerce <= 1.62.0
Fix: upgrade to 1.62.1
Original advisory text
WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published29 Oct 2026
Updated30 Oct 2026
First seen29 Oct 2026
Sources
CVE-2026-27401 · NVD
CVE-2026-27401 · MITRE
Track software like this
Free during beta