CVE-2026-45209

Vulnerability

The MyCryptoCheckout WordPress plugin versions 2.161 and earlier contain a missing authorization vulnerability. The plugin fails to properly enforce access control checks on certain functions, allowing users with low privileges to perform actions that should require higher privileges. This is classified as a broken access control issue [1].

Exploitation

An attacker with an unprivileged account (e.g., subscriber) can exploit this by sending crafted HTTP requests to the vulnerable endpoints. No additional authentication or special network position is required beyond being a registered user of the WordPress site. The vulnerability is expected to be used in mass-exploit campaigns targeting thousands of sites [1].

Impact

Successful exploitation allows the attacker to execute higher-privileged actions, potentially leading to unauthorized modification of plugin settings, access to sensitive data, or full administrative control of the WordPress site. The vulnerability is considered highly dangerous due to its ease of exploitation and widespread impact [1].

Mitigation

The vulnerability is fixed in version 2.162 of the plugin. Users should update immediately. If updating is not possible, Patchstack provides a mitigation rule to block attacks until the update can be applied. The plugin is actively targeted in mass-exploit campaigns [1].