CVE-2026-106609— WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability
Quick assessment
Affected
Web Impian Bayarcash WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Web 梦想 Bayarcash WooCommerce 插件 bayarcash-wc 中存在缺失授权漏洞，可导致利用错误配置的访问控制安全级别。该问题影响 Bayarcash WooCommerce 插件：从 n/a 到 4.4.2 版本均受影响。
Possible ATT&CK Techniques 3 AI
T1059.001 · PowerShell T1078 · Valid Accounts T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Web Impian | Bayarcash WooCommerce | ≤ 4.4.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106609
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Web Impian | Bayarcash WooCommerce | 0 ~ 4.4.2 | - |
|
II. Public POCs for CVE-2026-106609
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106609
请登录查看更多情报信息。
News Coverage for CVE-2026-106609 (1)
IV. Related Vulnerabilities
Same weakness: CWE-862
-
CVE-2026-108708
Wukong_HRM through commit 186115e Missing Authorization via -
CVE-2026-108706
eladmin through commit 55fbf70 Missing Authorization via S3 -
CVE-2026-108705
CordysCRM through 1.9.3 Missing Authorization via /custom-fo -
CVE-2026-108703
CordysCRM through 1.9.3 Missing Authorization via /approval- -
CVE-2026-108702
CordysCRM through 1.9.3 Missing Authorization and Blind SSRF
V. Comments for CVE-2026-106609
No comments yet