CVE-2026-34891: IDPay WooCommerce Information Disclosure

CVE-2026-34891 Overview

CVE-2026-34891 is an unauthenticated sensitive data exposure vulnerability affecting the IDPay Payment Gateway for WooCommerce WordPress plugin in versions up to and including 2.2.5. The flaw is classified under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere). Remote attackers can access sensitive information without authentication or user interaction over the network. Patchstack published the advisory, and the issue was added to the National Vulnerability Database on 2026-06-15.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive data from WooCommerce stores running vulnerable versions of the IDPay payment gateway plugin, exposing customer and transaction information.

Affected Products

IDPay Payment Gateway for WooCommerce plugin (woo-idpay-gateway) versions <= 2.2.5
WordPress sites running WooCommerce with the IDPay gateway extension
E-commerce environments processing payments through the affected plugin

Discovery Timeline

2026-06-15 - CVE-2026-34891 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-34891

Vulnerability Analysis

The vulnerability stems from the IDPay Payment Gateway for WooCommerce plugin exposing sensitive system or transaction information to unauthorized requestors. Under [CWE-497], the application makes data accessible to actors who should not have visibility into it. Because the issue is reachable without authentication, any remote actor able to send HTTP requests to a vulnerable site can attempt exploitation.

The impact profile centers on confidentiality. The CVSS vector indicates high confidentiality impact, with no integrity or availability impact, meaning attackers can read sensitive data but cannot directly modify records or disrupt service through this flaw. Exposed information from a payment gateway typically includes transaction identifiers, payment metadata, configuration details, or customer-related fields.

Root Cause

The root cause is improper restriction of access to sensitive data within plugin endpoints or response payloads. The plugin returns information that should require authentication or authorization checks. See the Patchstack Vulnerability Report for advisory details.

Attack Vector

Attackers exploit the vulnerability over the network by issuing crafted HTTP requests to the vulnerable WordPress site. No credentials are required, and no user interaction is involved. Exploitation complexity is low, making automated mass scanning viable against exposed WooCommerce deployments.

No verified proof-of-concept code or public exploit is currently associated with this CVE. The EPSS score is 0.303%, indicating a relatively low predicted likelihood of exploitation in the short term.

Detection Methods for CVE-2026-34891

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to IDPay plugin endpoints under /wp-content/plugins/woo-idpay-gateway/ or related WooCommerce payment callback URLs
Anomalous outbound HTTP responses containing transaction identifiers, order metadata, or plugin configuration values
Repeated enumeration patterns from a single source IP targeting payment gateway paths

Detection Strategies

Inventory WordPress installations and identify sites running woo-idpay-gateway version 2.2.5 or earlier
Review web server access logs for unauthenticated requests to IDPay plugin paths returning non-empty response bodies
Correlate WAF and reverse-proxy telemetry for scraping behavior against WooCommerce checkout and callback endpoints

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for query and alerting on plugin-specific paths
Alert on bursts of requests to payment gateway endpoints from unauthenticated sessions
Track plugin version inventory changes to confirm patch deployment across all WordPress instances

How to Mitigate CVE-2026-34891

Immediate Actions Required

Identify all WordPress sites using the IDPay Payment Gateway for WooCommerce plugin and confirm the installed version
Upgrade the woo-idpay-gateway plugin to a version newer than 2.2.5 as soon as the vendor publishes a fixed release
Restrict administrative and plugin endpoint access by IP allowlists or WAF rules until patching is complete
Review web server logs for prior unauthenticated access to plugin endpoints and assess potential data exposure

Patch Information

Refer to the Patchstack Vulnerability Report for the latest remediation guidance and fixed-version availability. Apply the vendor-supplied update through the WordPress plugin manager once published.

Workarounds

Temporarily deactivate the IDPay Payment Gateway for WooCommerce plugin if a patch is unavailable and an alternative gateway can be used
Place the WordPress site behind a Web Application Firewall configured to block unauthenticated requests to IDPay plugin endpoints
Apply virtual patching rules at the reverse proxy or WAF layer to filter responses containing sensitive payment metadata

bash

# Example WAF rule pattern (ModSecurity) to block unauthenticated access to plugin paths
SecRule REQUEST_URI "@beginsWith /wp-content/plugins/woo-idpay-gateway/" \
    "id:1009001,phase:1,deny,status:403,log,msg:'Block IDPay plugin endpoint access - CVE-2026-34891'"