CVE-2026-66442: YayPricing Auth Bypass Vulnerability

CVE-2026-66442 Overview

CVE-2026-66442 is a broken access control vulnerability in the YayPricing WordPress plugin affecting versions 3.5.6 and earlier. The flaw allows authenticated users with subscriber-level privileges to perform actions that should be restricted to higher-privileged roles. The issue is tracked under CWE-862 (Missing Authorization).

An attacker holding a low-privilege WordPress account can leverage this weakness to affect plugin state or configuration. The vulnerability has network attack vector and requires low privileges with no user interaction.

Critical Impact
Authenticated subscribers can bypass authorization controls in YayPricing to affect integrity and availability of plugin functionality on WordPress sites running vulnerable versions.

Affected Products

YayPricing WordPress plugin versions <= 3.5.6
WordPress sites permitting subscriber-level registration with YayPricing installed
Multisite WordPress deployments running the affected plugin version

Discovery Timeline

2026-07-27 - CVE-2026-66442 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-66442

Vulnerability Analysis

The YayPricing plugin exposes one or more endpoints that fail to verify the caller's capability before executing sensitive operations. WordPress uses a role and capability model where subscriber is the lowest authenticated role. Actions modifying plugin behavior should require manage_options or an equivalent capability check.

Because the plugin omits this check, any authenticated user can invoke the affected handlers. This maps to CWE-862: Missing Authorization. The EPSS probability is 0.223% at the 13th percentile, indicating low observed exploitation activity as of the scoring date.

Root Cause

The root cause is missing or insufficient authorization checks in YayPricing plugin request handlers. Handlers likely validate that the request comes from an authenticated session but do not call current_user_can() with an appropriate capability. WordPress AJAX actions registered under wp_ajax_ are reachable by every authenticated role unless the handler enforces its own authorization.

Attack Vector

Exploitation requires a valid WordPress account at subscriber level or higher. The attacker sends a crafted request to the vulnerable plugin endpoint over HTTP or HTTPS. No user interaction from an administrator is required.

Sites that allow open user registration are at higher risk because attackers can create their own subscriber accounts. The vulnerability affects integrity and availability of plugin data but does not directly disclose confidential information. See the Patchstack YayPricing Plugin Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-66442

Indicators of Compromise

Unexpected changes to YayPricing pricing rules, discounts, or configuration entries in the WordPress database
HTTP POST requests to admin-ajax.php or plugin REST routes originating from subscriber-level accounts
New or modified plugin option rows in wp_options where the actor is not an administrator

Detection Strategies

Review WordPress audit logs for plugin configuration changes performed by non-administrator users
Correlate authenticated session activity against role assignments to identify subscribers invoking privileged actions
Inspect web server access logs for repeated requests to YayPricing endpoints from low-privilege user sessions

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture role-based action attribution
Forward WordPress and web server logs to a centralized SIEM for correlation and alerting on anomalous plugin activity
Monitor account creation events on sites with open registration, particularly newly registered subscribers making immediate admin-ajax requests

How to Mitigate CVE-2026-66442

Immediate Actions Required

Update YayPricing to a version later than 3.5.6 once the vendor releases a patched build
Audit existing subscriber accounts and remove or downgrade any that are not legitimately required
Disable open user registration under Settings > General if the site does not require it

Patch Information

Refer to the Patchstack YayPricing Plugin Vulnerability advisory for the vendor's fixed version and update guidance. Apply the update through the WordPress plugin manager or WP-CLI as soon as it is available.

Workarounds

Temporarily deactivate the YayPricing plugin until a fixed release is applied
Restrict access to wp-admin/admin-ajax.php from unauthenticated sources at the web application firewall or reverse proxy layer
Apply a virtual patch through a WordPress security plugin that blocks subscriber-level access to YayPricing action names

bash

# Update YayPricing using WP-CLI once a fixed version is published
wp plugin update yaypricing --version=<fixed-version>

# Verify the installed version
wp plugin get yaypricing --field=version

# Disable open registration as a hardening measure
wp option update users_can_register 0