Authorization Bypass in YayPricing WordPress Plugin
CVE-2026-87888
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-87888?
The YayPricing WordPress plugin prior to version 3.5.7 is susceptible to an authorization bypass vulnerability that affects its REST API. It fails to adequately check user permissions for a specific REST route responsible for storing pricing rules. As a result, unauthorized users with subscriber-level access and above can inject malicious JavaScript code. This code executes in the browser of any administrator who visits the settings page of the YayPricing plugin, posing potential security risks and exposing sensitive data.
Affected Version(s)
YayPricing 0 < 3.5.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.