CVE-2026-15230: Unknown Yaypricing

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes.

Affected products

• Unknown Yaypricing: before 3.5.7 (fixed in 3.5.7)

Published 2026-08-05. Last modified 2026-08-26.