CVE-2026-95589: Missing Authorization in Magepeople inc. Deposits and Partial Payments for WooCommerce

The vulnerability identified as CVE-2026-95589 involves missing authorization checks in the Deposits and Partial Payments for WooCommerce plugin by Magepeople inc. This issue arises from incorrectly configured access control security levels, potentially allowing unauthorized users with limited privileges to perform actions they should not be permitted to. The affected versions range from the earliest versions up to 4.0.1. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows unauthorized modification or manipulation of deposit and partial payment functionalities due to missing authorization controls. This can lead to integrity issues within the payment processing of WooCommerce stores using the affected plugin versions. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Magepeople inc.'s advisories for updates and apply patches once available. Until then, consider restricting access to affected plugin functionalities to trusted users only.