yaypricing

YayPricing before 3.5.7 exposes a REST route that saves pricing rules without checking authorization. A subscriber can store JavaScript in a rule; it executes in an administrator's browser when the administrator opens the plugin settings page. The authoritative export does not name the route, request field, or output context.

YayPricing before 3.5.7 protects several REST routes only with a shared nonce and omits capability checks. Any authenticated user, including a Subscriber who can obtain the nonce, can overwrite the store's pricing configuration and disclose private coupon codes. This unscored record received deeper review because a low-privilege account gains a store-configuration write primitive and sensitive promotion data.

YayPricing through 3.5.6 lets a Subscriber reach a plugin operation without the required capability or ownership check.

YayPricing is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.