CVE-2026-76058
Received Received - Intake

Authorization Bypass in PayPal Brasil para WooCommerce Plugin

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: Wordfence

Description
The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disable or enable the PayPal Brasil BCDC payment gateway and overwrite its WooCommerce gateway settings, removing PayPal from checkout for all customers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-76058
EUVD
EUVD-2026-111742

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
odefranca PayPal Brasil para WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The PayPal Brasil para WooCommerce plugin for WordPress has an authorization bypass vulnerability in versions up to 1.7.8. The plugin fails to properly verify user permissions before allowing actions. This allows unauthenticated attackers to disable or enable the PayPal Brasil BCDC payment gateway and modify its settings, potentially removing PayPal from customer checkout options.

Detection Guidance

Check if the PayPal Brasil para WooCommerce plugin version is 1.7.8 or lower. Inspect WordPress plugin files for unauthorized modifications to gateway settings or PayPal BCDC payment gateway status changes.

Impact Analysis

Unauthenticated attackers could disable PayPal as a payment option for all customers, disrupting transactions. They could also reconfigure gateway settings, potentially redirecting payments or causing financial losses. The vulnerability does not directly expose sensitive data but may impact business operations and customer trust.

Mitigation Strategies
  • Update the PayPal Brasil para WooCommerce plugin to the latest version immediately.
  • Review and restore any altered WooCommerce gateway settings to their original configuration.
  • Monitor for unauthorized changes to payment gateway configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart