This vulnerability (CVE-2026-39448) is classified as CWE-862, indicating missing authorization in the NOWPayments for WooCommerce plugin by CoderPress. Versions up to and including 1.4.0 are affected. The issue allows unauthenticated attackers to bypass access controls, potentially leading to unauthorized modification or manipulation of data or operations within the plugin. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no information about known exploits in the wild or vendor-provided patches at this time.

The vulnerability allows unauthenticated attackers to bypass access controls, leading to a high impact on data integrity within the affected plugin. Confidentiality and availability are not impacted. This could result in unauthorized changes to payment or transaction data managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the plugin's interfaces or disabling the plugin if feasible to reduce exposure.