CVE-2026-108493: Missing Authorization in Karolína Vyskočilová Pay for Payment for WooCommerce

The Pay for Payment for WooCommerce plugin suffers from a missing authorization vulnerability that results from improperly configured access control. This allows unauthorized users to perform actions that should require authorization. The issue affects all versions from the initial release up to version 3.0.1. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

Exploitation of this vulnerability could allow an attacker to perform unauthorized actions within the Pay for Payment for WooCommerce plugin, potentially modifying payment-related settings or processes. The impact is limited to integrity as per the CVSS vector, with no confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's administrative functions to trusted users only and monitor for any suspicious activity related to payment configurations.