CVE-2026-108492: Missing Authorization in Fullworks Plugins Quick Paypal Payments

The vulnerability identified as CVE-2026-108492 affects the Fullworks Plugins Quick Paypal Payments plugin, specifically versions from initial release up to 6.0.3 inclusive. It is a missing authorization issue where access control security levels are incorrectly configured, allowing unauthorized exploitation. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

Exploitation of this vulnerability could allow an attacker to perform unauthorized actions due to missing authorization checks. The impact is limited to integrity as per the CVSS vector, with no direct confidentiality or availability impact. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates and apply any official patches once available. Until then, review and tighten access control configurations where possible to mitigate risk.