CVE-2026-24606: 
WordPress vulnerability analysis and mitigation

CVE-2026-24606 is a Missing Authorization vulnerability in the Bayarcash WooCommerce WordPress plugin developed by Web Impian. The flaw allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially performing unauthorized actions. It affects all versions of the plugin through 4.3.13 (initially disclosed as affecting through 4.3.11, later updated). The vulnerability was first published on January 23, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions or exposing functionality. Because no authentication or privilege check is enforced on the affected endpoint(s), any network-accessible attacker can trigger restricted operations without credentials. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit (Patchstack).

Successful exploitation results in a low-integrity impact on the affected WordPress/WooCommerce installation, with no direct confidentiality or availability impact per the CVSS assessment. An unauthenticated attacker could manipulate or alter data or plugin behavior that should be restricted to authorized users, potentially interfering with payment gateway configurations or order processing managed by the Bayarcash WooCommerce plugin. The scope is limited to the affected plugin's functionality and does not directly enable full system compromise or data exfiltration (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2026-24606. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the Bayarcash WooCommerce plugin to a version beyond 4.3.13, which is the last confirmed vulnerable release. The vulnerability was initially reported against version 4.3.11 and later updated to include 4.3.13, so any patched release released after 4.3.13 should be applied. WordPress site administrators should monitor the official plugin repository or vendor communications from Web Impian for a patched release and apply it promptly (Patchstack).