Read the docs
TI-2026-71613 Aliases CVE-2026-108492GHSA-xxg6-q3fq-9xq2

WordPress Quick Paypal Payments plugin missing authorization

Priority LOW 29CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Fullworks Plugins' Quick Paypal Payments plugin (quick-paypal-payments) for WordPress has a missing authorization flaw (CWE-862) in versions from n/a through 6.0.3. The plugin does not check access control properly, which lets an unauthenticated user with network access reach functionality they should not use. The CVSS 3.1 base score is 5.3 (MEDIUM), with low integrity impact and no confidentiality or availability impact. CISA's SSVC assessment marks the issue as automatable with partial technical impact and no known exploitation, and it is not in CISA's KEV catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00178 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FullworksQuick Paypal Paymentsup to 6.0.3—No fix listedCNA
  • Quick Paypal Payments VendorFullworks Affected up to 6.0.3 Fixed in — No fix listed CNA

Remediation

No fix is listed for affected versions. Review the plugin's status with Fullworks Plugins, restrict access to the plugin where possible, and watch for an updated release that fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-108492
  2. 2026-10-13 Alias added: GHSA-xxg6-q3fq-9xq2
  3. 2026-10-13 CISA SSVC decision points changed

References

Other 1

  • TI-2023-09326 Cross-site scripting in Quick Event Manager WordPress Plugin CVSS 3.1MEDIUM 6.1
  • TI-2025-03831 Stop User Enumeration < 1.7.3 - Protection Bypass CVSS 3.1MEDIUM 5.3
  • TI-2023-01466 Quick Paypal Payments < 5.7.26.4 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
  • TI-2023-10990 WordPress Quick Paypal Payments plugin <= 5.7.25 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
  • TI-2025-30007 WordPress Display Eventbrite Events plugin < 6.3 - Local File Inclusion Vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-10508 WordPress Quick Contact Form plugin <= 8.0.3.1 - Broken Access Control vulnerability CVSS 3.1MEDIUM 6.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences