CVE-2026-16058 Overview
CVE-2026-16058 is an Insecure Direct Object Reference (IDOR) vulnerability in the YayCurrency WordPress plugin before version 3.3.5. The plugin fails to perform capability or ownership checks on several multi-vendor integration handlers reachable by unauthenticated users. Attackers can iterate over identifiers to read store order totals, vendor earnings, balance ledgers, and withdrawal histories. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Unauthenticated attackers can enumerate sensitive financial data belonging to store owners and vendors, including order totals, earnings, and withdrawal histories.
Affected Products
- YayCurrency WordPress plugin versions prior to 3.3.5
- WordPress sites using YayCurrency multi-vendor integrations
- E-commerce stores relying on the plugin's vendor handlers
Discovery Timeline
- 2026-08-19 - CVE-2026-16058 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-16058
Vulnerability Analysis
The YayCurrency plugin exposes multi-vendor integration endpoints to unauthenticated HTTP requests. These handlers accept identifier parameters that reference vendor and order records. The handlers do not verify whether the caller has permission to access the referenced object. Any anonymous visitor can request records by supplying valid identifiers.
Because identifiers are sequential or otherwise guessable, an attacker can iterate through the identifier space and harvest all associated data. The exposed data includes store order totals, per-vendor earnings, balance ledgers, and withdrawal histories. This produces a confidentiality impact without requiring authentication or user interaction.
Root Cause
The root cause is missing authorization logic in the plugin's REST or AJAX handlers that serve multi-vendor data. The handlers rely on the presence of a valid record identifier as the sole access control. There is no current_user_can() capability check and no ownership comparison between the requesting user and the target record owner. This pattern is characteristic of [CWE-639] authorization bypass through user-controlled keys.
Attack Vector
An unauthenticated remote attacker sends HTTP requests to the vulnerable handlers with iterated identifier values. Each response returns financial data associated with that identifier. The attack requires only network access to the WordPress site and knowledge of the endpoint paths documented in the WPScan Vulnerability Details. No credentials, user interaction, or elevated privileges are needed.
See the WPScan Vulnerability Details for endpoint-level technical information.
Detection Methods for CVE-2026-16058
Indicators of Compromise
- Repeated unauthenticated requests to YayCurrency multi-vendor endpoints with sequentially incrementing identifier parameters
- HTTP 200 responses returning vendor financial data to clients without authenticated session cookies
- Unusual spikes in requests to /wp-json/ or admin-ajax.php actions associated with YayCurrency vendor handlers
Detection Strategies
- Review web server and WordPress access logs for enumeration patterns targeting vendor or order identifier parameters
- Deploy WAF signatures that flag high-rate parameter iteration against WordPress REST or AJAX endpoints
- Correlate anonymous requests returning JSON payloads containing keys such as earnings, balance, or withdrawal
Monitoring Recommendations
- Enable verbose access logging for YayCurrency handler routes and retain logs for retrospective analysis
- Rate-limit unauthenticated requests to plugin endpoints at the reverse proxy or WAF layer
- Alert on any single client IP requesting more than a defined threshold of distinct identifier values within a short window
How to Mitigate CVE-2026-16058
Immediate Actions Required
- Upgrade the YayCurrency plugin to version 3.3.5 or later on all WordPress sites
- Audit access logs for evidence of prior enumeration against vendor handler endpoints
- Notify vendors whose financial data may have been exposed if enumeration activity is confirmed
Patch Information
The vendor released YayCurrency 3.3.5, which introduces capability and ownership checks on the affected multi-vendor integration handlers. Site administrators should update through the WordPress plugin manager or by replacing the plugin files with the patched release. See the WPScan Vulnerability Details for the fixed version reference.
Workarounds
- Restrict access to the vulnerable endpoints at the WAF or reverse proxy layer until the plugin is updated
- Temporarily disable the YayCurrency plugin if the multi-vendor integration is not in active use
- Block unauthenticated requests to plugin AJAX and REST routes using WordPress access control rules
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
