CVE-2026-16058 describes an authorization bypass vulnerability in the YayCurrency WordPress plugin prior to version 3.3.5. The plugin's multi-vendor integration handlers lack proper capability or ownership verification and are accessible without authentication. This flaw enables unauthorized users to access confidential financial data related to the store and its vendors by enumerating identifiers. There is no CVSS score or vendor advisory indicating a patch or remediation status.

Unauthorized disclosure of sensitive financial information including store order totals, vendors' earnings, balance ledgers, and withdrawal histories. This could lead to privacy violations and potential misuse of financial data. No evidence of active exploitation is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected handlers by implementing additional access controls or disabling the vulnerable features if possible.