Description

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-12T06:16:27.890Z",
  "pubdate": "2026-09-12T06:16:27.890Z",
  "executiveSummary": "The YayPricing WordPress plugin prior to version 3.5.7 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from an insufficient authorization check on a REST API endpoint responsible for persisting pricing configuration rules. By exploiting this vulnerability, an attacker authenticated as a subscriber or higher can inject malicious JavaScript into the plugin's settings. The stored script is subsequently executed within the context of an administrator's browser session when they access the plugin's configuration interface. This vulnerability presents a significant risk, as it permits unauthorized code execution in a privileged user's browser, potentially leading to full site compromise, unauthorized administrative actions, data exfiltration, or the creation of rogue administrator accounts through the abuse of legitimate WordPress administrative functions.",
  "technicalDetails": "The vulnerability resides in the REST API handler within the YayPricing plugin that manages the storage of pricing rules. The core issue is an authorization bypass, where the endpoint fails to verify that the user requesting the configuration update possesses the 'manage_options' or equivalent administrative capability. Instead, the implementation allows any user with a registered role, including 'subscriber', to interact with the save functionality.\nThe attack flow proceeds as follows: First, an attacker authenticates as a user with at least subscriber-level access. The attacker then crafts a malicious request targeting the vulnerable REST API route used by YayPricing to save pricing rules. Within the JSON payload sent to this endpoint, the attacker embeds a malicious JavaScript payload disguised as legitimate configuration data. Because the plugin lacks proper input validation and sanitization for these configuration fields, the malicious script is persisted directly into the WordPress database.\nThe payload remains dormant until an administrator navigates to the YayPricing settings page. When the administrator loads this page, the plugin retrieves the compromised configuration rules from the database and renders them in the browser. Since the plugin fails to encode or sanitize this data during the output process, the browser interprets the stored JavaScript payload as legitimate code and executes it within the administrator's security context.\nThe post-exploitation impact is severe due to the context of execution. By running arbitrary code in the browser of an administrator, an attacker can perform any action the administrator can perform on the site. This includes, but is not limited to, modifying sensitive plugin settings, altering site content, injecting malicious code into theme files via the WordPress editor, or creating new administrative accounts. Furthermore, because the execution occurs within the administrator's session, the attacker may bypass traditional CSRF protections, facilitating stealthy lateral movement across the WordPress installation and potentially leading to a complete takeover of the site."
}