CVE-2026-95597: Missing Authorization in PGALL for WooCommerce

CVE-2026-95597 identifies a Missing Authorization vulnerability in the PGALL for WooCommerce plugin, used to manage payments on WordPress stores. The flaw allows unauthenticated access to payment system configuration settings, potentially exposing API keys, routing configurations, and critical parameters without requiring credentials. The defect lies in incorrectly configured access controls that fail to adequately validate user authorization before permitting settings modifications.

The CVSS score is 6.5 (medium), classified as a medium-severity vulnerability but with significant impact for e-commerce using this plugin. The CVE was published October 9, 2026, and as of today, November 7, 2026, a public proof of concept is available on GitHub repositories. Unauthenticated access to settings represents a coherent signal of operational risk and sensitive data confidentiality exposure. Consistency between official NVD description and public signals confirms tangible risk.

For sysadmins and IT teams: immediately verify which version of PGALL for WooCommerce is installed on your WordPress stores. If version 5.5.17 or earlier, prioritize updating to the available patch release. In the interim, implement WAF or firewall restrictions on plugin configuration endpoints, limiting access from known IP addresses and requiring additional authentication for payment settings modifications. Monitor logs for anomalous access to plugin settings sections and consider temporarily disabling the module pending patch release.