Plisio Plugin Flaw: Unauthenticated Access Control Bypass

A significant “Missing Authorization” vulnerability, tracked as CVE-2026-6372, has been identified in the “Accept Cryptocurrencies with Plisio” plugin. According to the National Vulnerability Database, this flaw allows for the exploitation of incorrectly configured access control security levels, presenting a clear path for unauthenticated attackers to bypass authorization. The issue impacts versions of the Plisio plugin up to and including 2.0.5.

This isn’t some esoteric bug; a CVSS v3.1 score of 7.5 (HIGH) with an AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N vector means it’s exploitable over the network without any user interaction or privileges. Essentially, an attacker could manipulate access controls to achieve a high impact on integrity (I:H), though confidentiality and availability are not directly impacted by this specific vector. The root cause is categorized under CWE-862, which points directly to insufficient authorization checks—a classic blunder that often leads to serious headaches down the line.