Description

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T06:17:34.670Z",
  "pubdate": "2026-08-19T06:17:34.670Z",
  "executiveSummary": "An information disclosure vulnerability exists in the YayCurrency WordPress plugin before version 3.3.5. The vulnerability stems from a failure to perform adequate capability or ownership checks on several multi-vendor integration handlers accessible via the web interface. Unauthenticated remote threat actors can exploit this security flaw to compromise sensitive financial and operational data belonging to the e-commerce store and its registered vendors.\nThe impact of successful exploitation includes the unauthorized enumeration and exfiltration of the store's total order revenue alongside comprehensive vendor-specific financial records, such as individual earnings, balance ledgers, and historical withdrawal data. Because the affected endpoints are reachable without authentication, attackers can automate the enumeration process by systematically iterating through valid resource identifiers. This exposes critical business intelligence and proprietary financial metrics, posing substantial operational and privacy risks to marketplace operators.",
  "technicalDetails": "The vulnerability resides within the multi-vendor integration handlers implemented by the YayCurrency WordPress plugin. Specifically, the affected software components fail to enforce proper access control lists (ACLs), authorization checks, or user ownership validation prior to processing incoming requests. These handlers are exposed via endpoints accessible to unauthenticated network entities.\nThe root cause of the vulnerability is the absence of security checks such as current_user_can() capabilities validation or nonce verification within the vulnerable request-handling functions. When an unauthenticated HTTP request is submitted to these multi-vendor integration handlers, the application processes the query parameters without verifying whether the requesting entity possesses the administrative privileges or vendor ownership rights required to access the requested data sets.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies the accessible multi-vendor integration handler endpoints exposed by the plugin. Second, the attacker formulates programmatic HTTP requests targeted at these endpoints. Third, by systematically iterating through identifiers (such as vendor IDs or order IDs), the attacker bypasses all access restrictions. Fourth, the vulnerable handlers process the iterative requests and return sensitive JSON or serialized data containing store order totals, vendor earnings, balance ledgers, and withdrawal histories directly to the client. The attack requires network access to the target WordPress installation and can be fully automated using simple scripting tools or penetration testing utilities."
}