CVE-2026-16058CWE-639

CVE-2026-16058

Medium · published August 19, 2026

CVSS v3.1

5.3

EPSS

Percentile

24.1

In the wild

Unconfirmed

What it is

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00323 · 24.1th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-08-19T10:17Z

References (1)

https://wpscan.com/vulnerability/d32d7086-9a43-4d98-80d7-18a3f82797bb/ · [email protected]

EPSS history

Timeline

19 AUG 06:00Z
YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration
cvelistv5