CVE-2026-56048 is an authorization bypass vulnerability classified under CWE-639 affecting the Payment Gateway Based Fees and Discounts for WooCommerce plugin. It allows unauthenticated attackers to exploit insecure direct object references (IDOR) in versions up to and including 3.0.0, enabling unauthorized changes to fees and discounts. The vulnerability does not require privileges or user interaction and has network attack vector. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

The vulnerability enables attackers without authentication to bypass authorization controls and manipulate fees and discounts in the affected WooCommerce plugin. This could lead to integrity and availability impacts, such as unauthorized discount application or fee modification, potentially affecting business revenue or transaction processing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected plugin functionality or implementing compensating controls to detect or prevent unauthorized changes.