Is CVE-2026-56048 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56048 being exploited in the wild.

How severe is CVE-2026-56048?

Medium severity, with a CVSS score of 6.5, published 26 June 2026.

Is there a fix for CVE-2026-56048?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56048 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56048?

Check whether you run Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56048: Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce IDOR

CVE-2026-56048 · Severity: medium · CVSS 6.5 · Published 2026-06-26

A vulnerability exists in a WordPress plugin used to manage additional fees or discounts based on the payment method selected at checkout. An unauthenticated attacker can exploit this flaw to bypass authorization checks and potentially modify or interact with data they should not have access to. This could lead to unauthorized changes in transaction details or disruption of the payment process.

Vendors: Tyche Softwares.

Quick answers

Is CVE-2026-56048 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56048 being exploited in the wild.
How severe is CVE-2026-56048?: Medium severity, with a CVSS score of 6.5, published 26 June 2026.
Which products and versions are affected?: Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0.
Is there a fix for CVE-2026-56048?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56048 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56048?: Check whether you run Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Payment Gateway Based Fees and Discounts for WooCommerce plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions up to and including 3.0.0. The vulnerability stems from insufficient authorization checks when accessing or modifying objects via user-controlled input. An unauthenticated remote attacker can exploit this by sending crafted requests to interact with database objects or sensitive files without proper permission. This can result in unauthorized data modification or integrity loss. The issue is addressed in version 3.1.0.

Affected products

Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0

Timeline

2026-03-24: other: Reported by Jakub Herman
2026-06-25: disclosed: Vulnerability published by Patchstack
2026-06-26: advisory: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.