This vulnerability (CVE-2026-56048) involves an authorization bypass via Insecure Direct Object References (CWE-639) in the Payment Gateway Based Fees and Discounts for WooCommerce plugin by tychesoftwares. Versions up to 3.0.0 are affected. The flaw allows unauthenticated attackers to manipulate user-controlled keys to bypass authorization checks, potentially altering fees and discounts without proper permissions. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with low attack complexity. The impact includes integrity and availability loss. No vendor advisory or patch information is currently available.

An attacker can exploit this vulnerability to bypass authorization controls and manipulate fees and discounts in the affected WooCommerce plugin without authentication. This can lead to unauthorized changes in pricing logic, potentially causing financial loss or service disruption. The CVSS score reflects a medium severity with impacts on integrity and availability but no direct confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor for updates from tychesoftwares and consider restricting access to the affected plugin functionality if possible.