CVE-2026-86791
CVE-2026-86791 · iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.
CVSS 5.3 · Medium · EPSS 0.1% · Fix available
- Published
- Updated
Affected products and versions
ipospays payment gateway for woocommerce
- Versions
- ≥ 0, < 1.4.7: Affected (semver)
Update to 1.4.7