YayCurrency <3.3.5 IDOR Vulnerability (CVE-2026-16058) Unauth Data Disclosure

Vulnerability Overview Vulnerability Name: YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration Description: The plugin fails to perform any capability or ownership checks on multiple multi-vendor integration handlers, which are accessible to unauthenticated users. This allows anyone to read the store's order totals and vendor income, balance ledgers, and withdrawal history by iterating through identifiers. CVE ID: CVE-2026-16058 Classification: Type: IDOR (Insecure Direct Object Reference) OWASP Top 10: A5: Broken Access Control CWE: CWE-639 CVSS Score: 5.3 (medium) Affected Scope Affected Plugin: YayCurrency Fixed Version: 3.3.5 Remediation Fixed Version: YayCurrency 3.3.5 Release Date: 2026-08-17 Timeline Public Disclosure Date: 2026-08-17 Added Date: 2026-08-17 Last Updated: 2026-08-17 Additional Information Original Researcher: Shivamani Vastra Submitter: Shivamani Vastra Verification Status: Yes WPVDB ID: d32d7086-9a43-4d98-80d7-18a3f82797bb Related Vulnerabilities ilGhera Support System for WooCommerce < 1.3.1: Missing Authorization to Unauthenticated Sensitive Information Exposure Sensel LMS < 4.5.2: Arbitrary Private Message Sending via IDOR BookPro - Appointment Booking WordPress Plugin <= 1.1.0: Unauthenticated Insecure Direct Object Reference WP Project Manager - Task, team, and project management plugin featuring kanban board and gantt charts < 2.6.14: Insecure Direct Object Reference to Unauthenticated Authorization Bypass WP 2FA < 2.6.0: Subscriber+ Arbitrary Email Sending Summary The YayCurrency plugin, prior to version 3.3.5, contains an unauthenticated order and vendor financial data disclosure vulnerability facilitated through Dokan integration. This vulnerability allows unauthenticated users to access sensitive information, including order totals, vendor income, balance ledgers, and withdrawal history. The recommended mitigation is to upgrade to YayCurrency version 3.3.5.

Goal Reached Thanks to every supporter — we hit 100%!

YayCurrency <3.3.5 IDOR Vulnerability (CVE-2026-16058) Unauth Data Disclosure