Security Alert Summary
The WooPayments: Integrated WooCommerce Payments plugin for WordPress contains a missing capability check in the save_upe_appearance_ajax function in all versions up to and including 10.5.1. This allows unauthenticated attackers to modify plugin settings.
CVE Details
- CVE ID: CVE-2026-1710
- Affected component: WooPayments: Integrated WooCommerce Payments plugin for WordPress
- Affected versions: All versions up to, and including, 10.5.1
- Published: March 31, 2026 at 05:16:10 AM UTC
- Last modified: March 31, 2026 at 05:16:10 AM UTC
- CVSS v3.1: Base Score 6.5, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Authentication / Privileges / User interaction: No authentication required;
PR:N(Privileges Required: NONE);UI:N(User Interaction: NONE) - Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: LOW
- Weakness: CWE-285 (Improper Authorization)
Technical Details
The vulnerability exists because the plugin does not perform a required capability check in the save_upe_appearance_ajax function. The missing authorization check allows unauthenticated attackers to invoke that AJAX handler and update plugin settings without proper permissions. The description specifically identifies the absence of the capability check on that function as the root cause.
The practical effect is limited to modification of plugin settings via the affected endpoint or handler; the CVSS metrics indicate integrity and availability impacts are possible but limited (LOW), and there is no indicated confidentiality impact.
How This Could Impact Your Website
In a typical site environment, a site owner runs WooPayments while internal staff or external contractors help manage store settings. If an attacker can update plugin appearance or payment-related settings without authentication, they could alter payment display options or configuration, which may disrupt checkout behavior or cause partial service interruptions for customers. Because confidentiality impact is rated as NONE, the information in this vulnerability does not indicate direct disclosure of user data, but unauthorized changes to payment UI or settings can still lead to transactional problems and may increase opportunities for fraudulent or misleading interactions.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that may be able to trigger admin-facing functionality.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as unexpected settings changes or AJAX requests to admin endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/woocommerce-payments/tags/10.4.0/includes/class-wc-payment-gateway-wcpay.php#L4125
- https://plugins.trac.wordpress.org/changeset/3480315/woocommerce-payments/trunk/includes/class-wc-payment-gateway-wcpay.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cec13225-baa3-4f26-b2d2-af6106888c74?source=cve
