Executive brief
The iPOSpays Gateways WC plugin for WordPress, which facilitates credit card payments for online stores, contains a security flaw that allows unauthorized individuals to modify its configuration. An attacker could exploit this to overwrite critical payment gateway settings, such as API keys and secret tokens. This could lead to the disruption of payment processing or the redirection of transaction data, impacting the business's ability to collect revenue securely.
Technical details
The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization (CWE-862) in versions up to and including 1.3.7. The vulnerability exists in the REST API endpoint `/wp-json/ipospays/v1/save_settings`, where the 'permission_callback' is incorrectly set to '__return_true'. This allows unauthenticated remote attackers to access the endpoint without any capability checks or nonce verification. Consequently, an attacker can overwrite the 'woocommerce_ipospays_settings' option, including live API keys, secret keys, and payment tokens. This vulnerability was originally tracked as CVE-2026-4663 but is a duplicate of CVE-2026-39608.
Affected products
- iPOSpays iPOSpays Gateways WC up to and including 1.3.7
Timeline
- 2026-05-12: disclosed: Initial publication of the vulnerability details.
- 2026-05-12: advisory: Wordfence published the vulnerability advisory.