UNKNOWNCVE-2026-1710

WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax

Platform

wordpress

Component

woocommerce-payments

Fixed in

10.6.0

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_upe_appearance_ajax' function in all versions up to, and including, 10.5.1. This makes it possible for unauthenticated attackers to update plugin settings.

How to fix

Update to version 10.6.0, or a newer patched version

Monitor your dependencies automatically

Get notified when new vulnerabilities affect your projects. Free forever.

Start free
CVE-2026-1710 — Vulnerability Details | NextGuard | NextGuard