CVE-2026-110362

Executive Summary

CVE-2026-110362 is a Missing Authorization (CWE-862) vulnerability in the PlanetStudio Payment Gateway plugin for WordPress, affecting all versions up to and including 1.3.3. An unauthenticated remote attacker can exploit incorrectly configured access control to invoke functionality that should require authorization, potentially altering payment-related or plugin state. With a CVSS base score of 5.3 (Moderate), the flaw is network-reachable, requires no privileges or user interaction, and is currently unpatched with no public proof-of-concept or exploit code observed.

Technical Analysis

The vulnerability is classified under CWE-862 (Missing Authorization), which means one or more privileged functions, endpoints, or actions within the PlanetStudio Payment Gateway are exposed without a proper capability or nonce/permission check. The NVD description explicitly states this is a "Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway" that "allows Exploiting Incorrectly Configured Access Control Security Levels."

In WordPress plugin terms, this class of defect typically manifests when a registered action or REST/AJAX handler fails to call a permission callback (e.g., current_user_can()) or validate a nonce before processing a request. Because the endpoint is reachable over HTTP without authentication, the effective access-control boundary collapses: any remote client can reach the vulnerable handler regardless of role. The NVD entry does not disclose the specific function, hook, REST route, or parameter names, so the exact trigger surface cannot be enumerated from available data. What can be stated with confidence is the flaw class and mechanism: an access-control decision that should gate the operation is missing or misconfigured, and the affected versions run through 1.3.3.

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) tells us the flaw is remotely exploitable with low complexity and no authentication, but limited strictly to a low-integrity impact. There is no confidentiality or availability impact, and the scope is unchanged — meaning the attacker cannot directly escalate beyond the vulnerable component's own boundary. This profile is consistent with a state-modification primitive (e.g., changing a settings value, toggling a configuration option, or triggering a payment-gateway side effect) rather than data exfiltration or code execution.

No public exploit code, Nuclei template, or OSV package mapping was identified, and the vendor has not published a fix. This is an UNPATCHED condition per available evidence.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (CWE-862) and the CVSS profile, not from disclosed implementation details.

1. Reconnaissance / target identification. An attacker enumerates internet-facing WordPress sites and fingerprints the PlanetStudio Payment Gateway plugin. Detection is achievable via standard WordPress plugin enumeration techniques and plugin asset paths, or by HTTP body fingerprinting of the plugin's rendered pages. Shodan-style queries such as http.html:"planetstudio" can identify candidate hosts at scale.

2. Triggering the flaw (vulnerability-class level). Because authorization is missing on the affected handler, the attacker issues a direct request to the plugin endpoint that should be gated behind a privilege or capability check. The request does not require a valid session, role, or cookie. The specific endpoint, parameter names, and HTTP method are not specified in the NVD description and are not fabricated here.

3. Payload / execution. At the vulnerability-class level, exploitation is a plain unauthenticated request that reaches a privileged code path. There is no memory-corruption, injection, or deserialization primitive implied; the exploit is the absence of an authorization check. The payload is simply the request that invokes the unprotected action.

4. Post-exploitation impact. Consistent with the CVSS integrity-only, low-impact rating, the attacker can influence or modify plugin/payment-gateway state that should have been protected. There is no indicated path to reading sensitive data, achieving remote code execution, or causing denial of service. Any secondary effects would depend on how the plugin consumes the modified state, which is not disclosed.

Impact Assessment

The blast radius is limited to installations of the PlanetStudio Payment Gateway plugin at version 1.3.3 or earlier. Because the flaw is unauthenticated and network-reachable, exposure scales directly with the number of internet-facing vulnerable WordPress sites. However, the CVSS subscores cap the severity: C:N (no confidentiality), I:L (low integrity), A:N (no availability), S:U (unchanged scope). The realistic business impact is unauthorized modification of plugin or gateway configuration state — for example, altering values that should only be changeable by an administrator. For merchants or site operators using the gateway, this could translate to manipulated payment configuration or unexpected plugin behavior. Given the base score of 5.3, this should be triaged as Moderate priority. There is no evidence of exploit-in-the-wild, no CISA KEV listing, and no confirmed threat-actor campaign.

Detection Guidance

Sigma Rule

title: Unauthenticated Access to PlanetStudio Payment Gateway Privileged Action
id: 8f3c1a92-4d7e-4b21-9c0a-planetstudio862
status: experimental
description: Detects unauthenticated requests targeting PlanetStudio Payment Gateway endpoints that should require authorization (CVE-2026-110362).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110362
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_uri:
    cs_uri_stem|contains:
      - '/planetstudio'
      - '/planetstudio-payment-gateway'
  selection_method:
    cs_method:
      - 'POST'
      - 'GET'
  filter_authed:
    cs_cookie|contains: 'wordpress_logged_in'
  condition: selection_uri and selection_method and not filter_authed
falsepositives:
  - Legitimate unauthenticated front-end gateway actions
level: medium
tags:
  - attack.t1190
  - cwe.862

YARA Rule

rule CVE_2026_110362_PlanetStudio_Missing_Authorization
{
    meta:
        author = "valtersit.com"
        description = "Detects PlanetStudio Payment Gateway plugin artifacts related to CVE-2026-110362"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110362"
        date = "2026-01-01"

    strings:
        $slug1 = "planetstudio-payment-gateway" ascii wide nocase
        $slug2 = "PlanetStudio Payment Gateway" ascii wide nocase
        $slug3 = "planetstudio" ascii wide nocase

    condition:
        any of ($slug*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110362 PlanetStudio Payment Gateway Unauthenticated Access Attempt"; flow:established,to_server; http.uri; content:"planetstudio"; nocase; http.method; content:"POST"; http.cookie; content:!"wordpress_logged_in"; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110362; classtype:attempted-admin; sid:2026110362; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [http where url.path contains "planetstudio" and http.request.method == "POST"]
  [http where url.path contains "planetstudio" and http.request.method == "POST" and not exists(http.request.headers["Cookie"])]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*planetstudio*" (method="POST" OR method="GET")
| eval authed=if(match(cookie, "wordpress_logged_in"), "yes", "no")
| where authed="no"
| stats count values(uri_path) as paths by src_ip, status
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-110362,">
  <rule id="1103621" level="7">
    <decoded_as>web-accesslog</decoded_as>
    <url>planetstudio</url>
    <description>CVE-2026-110362: Possible unauthenticated access to PlanetStudio Payment Gateway privileged action</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_862,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • If the PlanetStudio Payment Gateway plugin is not actively required, deactivate and remove it to eliminate the attack surface.
   • Where the plugin must remain enabled, restrict access to its endpoints at the edge — enforce authentication or IP allowlisting via a WAF, reverse proxy, or web server rule for any path matching the plugin's routes.
   • Monitor web logs for unauthenticated requests to plugin-related URIs (see Detection Guidance) and alert on abnormal state-change activity.

2. Patch / upgrade steps.

   • No vendor patch has been published as of this report; affected versions run through 1.3.3. Track the vendor's release channel and the NVD entry for an updated fixed version before upgrading.
   • Do not deploy a version beyond 1.3.3 unless it is confirmed to address CWE-862 for this plugin. Verify any update against an authoritative advisory.

3. Long-term hardening.

   • Enforce least privilege and continuous plugin inventory so deprecated, abandoned, or unmaintained plugins are identified and retired.
   • Require authorization checks (current_user_can() and nonce validation) as a code-review gate for any custom or third-party WordPress integration handling payment operations.
   • Maintain network monitoring for T1190-class exploitation patterns against internet-facing WordPress components, and validate WAF/IDS coverage for CWE-862 access-control bypass attempts.

References

• NVD — CVE-2026-110362: https://nvd.nist.gov/vuln/detail/CVE-2026-110362
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• FIRST EPSS: Not yet scored (no EPSS value available at time of writing)
• CISA Known Exploited Vulnerabilities Catalog — not listed: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No threat-actor campaign or exploit-in-the-wild evidence has been identified for this CVE.