CVE-2026-56048— WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-56048
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| tychesoftwares | Payment Gateway Based Fees and Discounts for WooCommerce | n/a ~ 3.0.0 | - |
II. Public POCs for CVE-2026-56048
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56048
请登录查看更多情报信息。
Same Patch Batch · tychesoftwares · 2026-06-26 · 3 CVEs total
| CVE-2026-56060 | 7.5 HIGH | WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 7.1.1 - Sensitive Data |
| CVE-2026-57637 | 4.3 MEDIUM | WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery |
IV. Related Vulnerabilities
Same vendor: tychesoftwares
- CVE-2026-57637
WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8. - CVE-2026-56060
WordPress Print Invoice & Delivery Notes for WooCommerce plu - CVE-2026-42386
WordPress Order Delivery Date for WooCommerce plugin <= 4.5. - CVE-2026-6447
Call for Price for WooCommerce <= 4.2.0 - Authenticated (Adm - CVE-2026-25317
WordPress Print Invoice & Delivery Notes for WooCommerce plu
Same weakness: CWE-639
- CVE-2026-58653
PraisonAI - Authorization Bypass via Unvalidated project_id - CVE-2026-57680
WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object Re - CVE-2026-11896
My Calendar <= 3.7.14 - Insecure Direct Object Reference to - CVE-2026-12657
LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object - CVE-2026-9188
Appointment Bookings for Zoom GoogleMeet and more – Wappoint
V. Comments for CVE-2026-56048
No comments yet