Unauthenticated Broken Access Control in NOWPayments for WooCommerce

Executive Summary

The WordPress NOWPayments for WooCommerce Plugin, specifically versions 1.4.0 and below, has a Broken Access Control vulnerability (CVE-2026-39448).

This issue allows unauthenticated users to perform actions that normally require higher privileges because of missing authorization, authentication, or nonce token checks.

In other words, attackers who are not logged in can exploit this flaw to access or manipulate parts of the plugin that should be restricted.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability in NOWPayments for WooCommerce Plugin versions 1.4.0 and below allows unauthenticated users to perform privileged actions due to broken access control. Detection typically involves identifying if the vulnerable plugin version is installed and monitoring for unauthorized access attempts.

Since the vulnerability is related to missing authorization and authentication checks, you can detect exploitation attempts by monitoring HTTP requests to the WooCommerce plugin endpoints for suspicious or unauthorized actions.

To detect the presence of the vulnerable plugin version on your system, you can check the installed plugin version using WordPress CLI commands such as:

• wp plugin list --status=active | grep nowpayments-for-woocommerce

To monitor network traffic for potential exploitation attempts, you can use tools like tcpdump or Wireshark to filter HTTP requests targeting the plugin's endpoints, for example:

• tcpdump -i any -A -s 0 'tcp port 80 or tcp port 443' | grep -i nowpayments

Additionally, reviewing web server logs for unusual POST or GET requests to the plugin's URLs without proper authentication can help identify exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to perform unauthorized actions within the NOWPayments for WooCommerce plugin without needing to authenticate.

Such unauthorized actions can lead to manipulation or misuse of the plugin's functionality, potentially impacting the integrity of your e-commerce operations.

Although classified as low severity with a CVSS score of 7.5, these vulnerabilities are often exploited in mass campaigns targeting many websites.

As of the report date, no official patch is available, so immediate updating or seeking assistance is advised to mitigate potential risks.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the Broken Access Control vulnerability in NOWPayments for WooCommerce affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability affects NOWPayments for WooCommerce plugin versions 1.4.0 and below, allowing unauthenticated users to perform privileged actions due to broken access control.

As of the report date, there is no official patch available.

• Update the plugin immediately once a patch is released.
• In the meantime, seek assistance from your hosting provider or developer to implement temporary mitigations or access restrictions.

Useful 0 Not Useful 0