WordPress Plugin Vulnerabilities

iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery

Description

The plugin does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.

Proof of Concept

Affects Plugins

Plugin icon
ipospays-gateways-wc
Fixed in 1.4.7

References

CVE
CVE-2026-86791

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
04e70988-b0af-4f78-8e75-5e76976b1797

Timeline

Publicly Published
2026-10-16 (about 3 days ago)
Added
2026-10-16 (about 2 days ago)
Last Updated
2026-10-16 (about 2 days ago)

Other

Published
Title
Published
2017-05-16
Title
WordPress 2.5.0-4.7.4 - Post Meta Data Values Improper Handling in XML-RPC
Published
2022-12-27
Title
FluentAuth < 1.0.2 - Bypass blocks by IP Spoofing
Published
2026-05-08
Title
Simple Cloudflare Turnstile < 1.38.1 - Unauthenticated CAPTCHA Bypass via Session Replay
Published
2019-10-14
Title
WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts
Published
2022-08-31
Title
Restricted Site Access < 7.3.2 - Access Bypass via IP Spoofing