# CVE-2026-27401: YITH PayPal Express Checkout for WooCommerce broken access control

Source: https://junglewise.ai/threats/cve-2026-27401-missing-authorization-vulnerability-in-yith-yith-paypal-express  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-27401 · Severity: medium · CVSS 5.3 · Published 2026-10-29

YITH PayPal Express Checkout for WooCommerce is a WordPress plugin that integrates PayPal payment processing into WooCommerce-based online stores. A broken access control vulnerability allows unauthenticated users to access pages or perform actions they should not be permitted to perform, potentially exposing sensitive checkout or order data.

Vendors: [YITH](https://junglewise.ai/threats/vendors/yith).

## Quick answers

**Is CVE-2026-27401 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27401 being exploited in the wild.

**How severe is CVE-2026-27401?** Medium severity, with a CVSS score of 5.3, published 29 October 2026.

**Which products and versions are affected?** YITH PayPal Express Checkout for WooCommerce through 1.62.0.

**Is there a fix for CVE-2026-27401?** Yes: fixed in 1.62.1. Until then: Update to version 1.62.1 or later. If unable to update immediately, contact your hosting provider or web developer for assistance. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27401 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27401?** Check whether you run YITH PayPal Express Checkout for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.62.1

Update to version 1.62.1 or later. If unable to update immediately, contact your hosting provider or web developer for assistance.

## Technical details

Broken access control in the YITH PayPal Express Checkout plugin allows unauthenticated attackers to access restricted pages or perform unauthorized actions via incorrectly configured access control checks. The vulnerability affects versions 1.62.0 and earlier, with a network attack vector requiring no authentication or user interaction. An attacker can view or manipulate data they should not have access to.

## Affected products

- YITH PayPal Express Checkout for WooCommerce through 1.62.0

## Timeline

- 2026-10-26: disclosed
- 2026-10-29: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/yith-paypal-express-checkout-for-woocommerce/vulnerability/wordpress-yith-paypal-express-checkout-for-woocommerce-plugin-1-62-0-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/yith-paypal-express-checkout-for-woocommerce/vulnerability/wordpress-yith-paypal-express-checkout-for-woocommerce-plugin-1-62-0-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [YITH PayPal Express Checkout broken access control](https://junglewise.ai/threats/cve-2026-111409-missing-authorization-vulnerability-in-yith-yith-paypal-express)