Is CVE-2026-81767 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81767 being exploited in the wild.

How severe is CVE-2026-81767?

High severity, with a CVSS score of 7.5, published 28 August 2026.

Which products and versions are affected?

Yalla Ya! Simple Payment <=2.5.2.

Is there a fix for CVE-2026-81767?

A patch was published on 2026-08-28: Fix available in version 2.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81767 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-81767?

Check whether you run Yalla Ya! Simple Payment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81767: Simple Payment WordPress plugin broken access control

Q: Is there a fix for CVE-2026-81767?

A patch was published on 2026-08-28: Fix available in version 2.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-81767 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-81767?

Check whether you run Yalla Ya! Simple Payment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81767 · Severity: high · CVSS 7.5 · Published 2026-08-28

The Simple Payment WordPress plugin is used by website administrators to process payments on their sites. An unauthenticated vulnerability allows attackers to access pages or perform actions they should not be permitted, such as viewing other users' payment data or transaction details without requiring a login or authorization. Websites using vulnerable versions are at risk of unauthorized data access and potential payment information exposure.

Technologies: Yalla Ya! Simple Payment. Vendors: Yalla Ya!.

Quick answers

Is CVE-2026-81767 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81767 being exploited in the wild.
How severe is CVE-2026-81767?: High severity, with a CVSS score of 7.5, published 28 August 2026.
Which products and versions are affected?: Yalla Ya! Simple Payment <=2.5.2.
Is there a fix for CVE-2026-81767?: A patch was published on 2026-08-28: Fix available in version 2.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81767 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-81767?: Check whether you run Yalla Ya! Simple Payment at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control flaw in the Simple Payment WordPress plugin versions 2.5.2 and earlier. The affected endpoints fail to properly enforce authorization checks, allowing unauthenticated users to directly access sensitive pages and functionality that should be restricted. The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this by sending crafted requests to unprotected endpoints to view or manipulate payment-related data. The vulnerability has been patched in version 2.5.3; affected site owners should update immediately.

Affected products

yalla ya! Simple Payment <=2.5.2

Timeline

2026-08-28: disclosed: Published on NVD and Patchstack
2026-08-28: patched: Fix available in version 2.5.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.