CVE-2026-15230 Overview
CVE-2026-15230 is a broken access control vulnerability [CWE-284] in the YayPricing WordPress plugin before version 3.5.7. The plugin exposes several REST API routes that rely only on a shared nonce for authorization and omit capability checks. Any authenticated user, including a low-privileged subscriber, can invoke these endpoints. Attackers can overwrite the store's pricing configuration and disclose private coupon codes. The issue affects WooCommerce stores that use YayPricing for dynamic pricing and discount rules.
Critical Impact
Authenticated subscribers can rewrite pricing rules and exfiltrate private coupon codes on affected WordPress storefronts, causing direct revenue loss and confidentiality exposure.
Affected Products
- YayPricing WordPress plugin versions prior to 3.5.7
- WordPress sites running WooCommerce with the vulnerable plugin installed
- Any storefront allowing subscriber-level registration with YayPricing enabled
Discovery Timeline
- 2026-08-05 - CVE-2026-15230 published to the National Vulnerability Database
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-15230
Vulnerability Analysis
The YayPricing plugin registers multiple REST API routes to manage pricing rules, discount configurations, and coupon data. These routes are protected by a permission_callback that validates a shared WordPress nonce but does not verify the caller's capabilities. Because any logged-in user can retrieve a valid nonce from an authenticated page load, the nonce check does not distinguish administrators from subscribers.
An authenticated attacker with the lowest WordPress role can call the affected endpoints and modify pricing state or read confidential coupon values. The vulnerability enables both integrity and confidentiality violations without requiring user interaction from an administrator.
Root Cause
The root cause is improper access control [CWE-284]. The plugin conflates authentication with authorization by treating nonce possession as sufficient proof of privilege. WordPress nonces protect against cross-site request forgery, not against horizontal or vertical privilege escalation. The missing current_user_can() capability check in the REST route permission_callback allows subscribers to invoke administrator-only functionality.
Attack Vector
Exploitation requires an authenticated session on the target site. Subscriber accounts are sufficient, and many WooCommerce sites allow open subscriber registration. The attacker obtains a valid REST nonce from any authenticated page, then issues crafted HTTP requests to the vulnerable YayPricing REST routes. One request path overwrites pricing rules, altering product prices and discount logic across the store. A second path returns private coupon codes intended only for administrators. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-15230
Indicators of Compromise
- Unexpected modifications to WooCommerce pricing rules or discount configurations that do not correspond to administrator activity.
- REST API requests to YayPricing routes originating from subscriber or customer accounts.
- Unusual read access to coupon endpoints returning private coupon codes to non-administrator sessions.
Detection Strategies
- Review web server access logs for requests to /wp-json/ paths associated with the YayPricing plugin from low-privileged user sessions.
- Correlate WordPress user role with REST API endpoint usage; subscribers should not be invoking pricing management routes.
- Enable WordPress audit logging to record changes to pricing rules and coupon objects, including the acting user ID.
Monitoring Recommendations
- Alert on any change to pricing configuration outside of scheduled administrator maintenance windows.
- Monitor new subscriber account creation followed shortly by REST API activity targeting plugin endpoints.
- Track outbound leakage of coupon codes by watching for high-volume coupon read requests.
How to Mitigate CVE-2026-15230
Immediate Actions Required
- Update the YayPricing plugin to version 3.5.7 or later on all affected WordPress sites.
- Audit existing subscriber and customer accounts for anomalous REST API activity since the plugin was installed.
- Rotate any private coupon codes that may have been disclosed prior to patching.
Patch Information
The vendor released YayPricing version 3.5.7, which adds proper capability checks to the affected REST API routes. Administrators should apply the update through the WordPress plugin dashboard or by deploying the fixed release from the plugin repository. Refer to the WPScan Vulnerability Report for the authoritative fix reference.
Workarounds
- Disable open subscriber registration on WooCommerce stores until the plugin is patched.
- Temporarily deactivate the YayPricing plugin if an immediate update is not feasible.
- Restrict access to /wp-json/ REST routes at the web application firewall for non-administrator sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
