CVE-2026-87888

The YayPricing WordPress plugin before version 3.5.7 fails to enforce an authorization check on a REST route that saves pricing rules, so any authenticated user with the subscriber role or above can write content into those rules. An attacker can embed JavaScript in a saved pricing rule, which then executes in the browser of an administrator who opens the plugin's settings page, making this a stored (persistent) cross-site scripting flaw. Because the script runs in the administrator's session, successful exploitation allows a low-privileged attacker to hijack admin access and fully compromise the site (for example, installing plugins or creating new administrators), consistent with the CVSS 3.1 score of 8.0 (high). Affected sites are those running YayPricing before 3.5.7, particularly WooCommerce stores with open user registration or other untrusted low-privileged accounts. No public proof of concept is known and the flaw is not on CISA's KEV list, so there is currently no evidence of exploitation in the wild.

What to do: Update YayPricing to version 3.5.7 or later, which adds the missing authorization check on the affected REST route. Until patched, disable open user registration and audit existing subscriber-and-above accounts, since any authenticated user can inject the payload. Review saved pricing rules for unexpected JavaScript or unfamiliar entries (these execute when an admin opens the settings page) and check for signs of admin session hijacking or newly created administrator accounts.