UNKNOWNCVE-2026-1710
WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax
Platform
wordpress
Component
woocommerce-payments
Fixed in
10.6.0
The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_upe_appearance_ajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to update plugin settings.
How to fix
Update to version 10.6.0, or a newer patched version
Monitor your dependencies automatically
Get notified when new vulnerabilities affect your projects. Free forever.
Start free