Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce

Executive Summary

CVE-2026-65434 is a Sensitive Data Exposure vulnerability in the ЮKassa для WooCommerce plugin for WordPress, affecting versions 2.16.1 and earlier. It allows attackers with Subscriber-level access to retrieve sensitive information that should be restricted to regular users. The vulnerability has a CVSS score of 6.5 and was patched in version 2.16.2.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress site is running ЮKassa для WooCommerce plugin version 2.16.1 or earlier. You can use commands like 'wp plugin list' in WP-CLI or inspect the plugin files directly for version information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized access to sensitive data, potentially leading to further exploitation of system weaknesses. Attackers might use the exposed data for identity theft, financial fraud, or other malicious activities. Users should update to version 2.16.2 or later to mitigate the risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes sensitive subscriber data, which could lead to unauthorized access to personal information. Such exposure may violate GDPR requirements for data protection and user privacy, as well as HIPAA rules for safeguarding protected health information if applicable. Compliance could be compromised due to unauthorized data access.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the ЮKassa для WooCommerce plugin to version 2.16.2 or later. If an update is not immediately possible, apply the mitigation rule provided by Patchstack to block attacks until the update is applied.

Useful 0 Not Useful 0