WordPress Plugin Vulnerabilities

Flutterwave WooCommerce <= 3.3.0 - Missing Authorization

Description

The Flutterwave WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
rave-woocommerce-payment-gateway
No known fix

References

CVE
CVE-2026-73399
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ee5ebdbf-2ea6-4d0c-adb3-af1ea53cda68

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Jakub Herman
Verified
No
WPVDB ID
d3ca437a-76cb-4c80-9960-f7c45d79c3e7

Timeline

Publicly Published
2026-08-18 (about 27 days ago)
Added
2026-08-24 (about 20 days ago)
Last Updated
2026-08-24 (about 20 days ago)

Other

Published
Title
Published
2024-04-05
Title
Advanced Local Pickup for WooCommerce < 1.6.3 - Missing Authorization
Published
2026-03-11
Title
Advanced Product Fields (Product Addons) for WooCommerce < 1.6.19 - Missing Authorization
Published
2024-04-22
Title
WP Club Manager < 2.2.12 - Missing Authorization
Published
2026-06-26
Title
Masteriyo LMS < 2.3.0 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification
Published
2025-01-30
Title
Food Menu – Restaurant Menu & Online Ordering for WooCommerce < 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update