A high-severity access control vulnerability in the YayPricing WordPress plugin allows authenticated users to manipulate store pricing and access sensitive coupon data.

This is an improper access control vulnerability (CWE-284) where the plugin fails to validate user capabilities on REST API routes, relying incorrectly on a shared nonce. Consequently, any authenticated user, including those with subscriber-level privileges, can perform unauthorized administrative actions.

With a CVSS score of 8.1, this vulnerability poses a high risk to business operations and data integrity. Successful exploitation allows an attacker to alter the store's pricing configuration, potentially resulting in direct financial loss or significant revenue disruption. Furthermore, the disclosure of private coupon codes may lead to unauthorized discounts and negative impacts on customer trust.

Immediate Action: Update the YayPricing WordPress plugin to version 3.5.7 or later immediately to implement the required capability checks.

Proactive Monitoring: Review web server and WordPress access logs for anomalous REST API requests or unauthorized modifications to pricing configuration settings.

Compensating Controls: If an immediate update is not feasible, consider implementing a Web Application Firewall (WAF) rule to restrict access to the vulnerable REST API endpoints.

Public Exploit Available: No (no confirmed public exploit exists in the provided data).

Given the ease of exploitation and the direct impact on store revenue and sensitive data, this vulnerability must be treated as a high priority. Administrators should verify their current version of YayPricing and apply the 3.5.7 patch without delay to prevent unauthorized access and potential configuration tampering.