CVE-2026-66431 HIGH

CVE-2026-66431: WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability

Vendor Woompaloompa
Product Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK)
Weakness CWE-862 · Missing authorization
Published August 13, 2026
Last update August 13, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.

Explanation of Vulnerability in Simple Terms

02Summary

The Bitcoin Lightning Payment Gateway for WooCommerce plugin fails to properly check user permissions before allowing certain actions. An attacker without authentication can modify payment data or transaction records by sending direct requests to the plugin. This could allow unauthorized changes to orders or payment status without requiring a valid user account.

What an attacker can do

03Attacker Capabilities

Modify payment transactions and order data without authentication.

Potential impact on your site

04Site Impact

Attackers can alter payment records, order status, or transaction data, potentially causing financial loss or order fulfillment errors.

Conditions required to exploit

05Prerequisites

Network access to the WooCommerce site; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-66678 WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability CVE-2026-11983 Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax CVE-2026-65554 WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability CVE-2026-28159 WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability CVE-2026-7520 MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action