CVE-2026-15230 describes an improper access control vulnerability (CWE-284) in the YayPricing WordPress plugin prior to version 3.5.7. The plugin fails to enforce capability checks on multiple REST API endpoints, relying only on a shared nonce for authentication. This flaw enables any authenticated user, regardless of privilege level, to modify the store's pricing settings and access private coupon codes. The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating network exploitable with low attack complexity, requiring low privileges, no user interaction, and causing high confidentiality and integrity impact without affecting availability.

Exploitation allows authenticated users with low privileges (e.g., subscribers) to overwrite pricing configurations and disclose private coupon codes, compromising the confidentiality and integrity of the store's pricing data. There is no impact on availability. This could lead to unauthorized price manipulation and leakage of sensitive promotional information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API routes in question by limiting authenticated user roles or applying custom capability checks. Monitor for updates from the vendor and apply the official patch once available.