CVE-2026-15230

A vulnerability exists in YayPricing plugin versions prior to 3.5.7 due to inadequate security measures in its REST API routes. Specifically, capability checks are bypassed by relying solely on a shared nonce, enabling any authenticated user with minimal privileges to modify the store's pricing settings and access sensitive coupon information.

Based on public CVE data (MITRE/NVD).