CVE-2026-96818

HighCVSS 7.5/10Last modified Sep 30, 2026

Description

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-968197.1Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.CVE-2026-968207.1Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.CVE-2026-968216.3Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.CVE-2026-968229.3Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.CVE-2026-968237.5Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.CVE-2026-968246.8Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.CVE-2026-968254.2Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.CVE-2026-968267.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List alloCVE-2026-968277.6Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.CVE-2026-968287.6Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.CVE-2026-968296.5Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.CVE-2026-968307.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.