Unauthenticated Broken Access Control in NOWPayments for WooCommerce

Executive Summary

The WordPress NOWPayments for WooCommerce Plugin, specifically versions 1.4.0 and below, has a Broken Access Control vulnerability (CVE-2026-39448).

This issue allows unauthenticated users to perform actions that normally require higher privileges because of missing authorization, authentication, or nonce token checks.

In other words, attackers who are not logged in can exploit this flaw to access or manipulate parts of the plugin that should be restricted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to perform unauthorized actions within the NOWPayments for WooCommerce plugin without needing to authenticate.

Such unauthorized actions can lead to manipulation or misuse of the plugin's functionality, potentially impacting the integrity of your e-commerce operations.

Although classified as low severity with a CVSS score of 7.5, these vulnerabilities are often exploited in mass campaigns targeting many websites.

As of the report date, no official patch is available, so immediate updating or seeking assistance is advised to mitigate potential risks.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability affects NOWPayments for WooCommerce plugin versions 1.4.0 and below, allowing unauthenticated users to perform privileged actions due to broken access control.

As of the report date, there is no official patch available.

• Update the plugin immediately once a patch is released.
• In the meantime, seek assistance from your hosting provider or developer to implement temporary mitigations or access restrictions.

Useful 0 Not Useful 0