CVE-2026-4663: iPOSpays Gateways WC Auth Bypass Flaw

CVE-2026-4663 Overview

The iPOSpays Gateways WC plugin for WordPress contains a missing authorization vulnerability affecting all versions up to and including 1.3.7. The plugin registers a REST API endpoint at /wp-json/ipospays/v1/save_settings with permission_callback set to __return_true. This configuration bypasses capability checks and nonce verification, exposing the endpoint to unauthenticated requests. Attackers can overwrite the woocommerce_ipospays_settings option, including live API keys, secret keys, and payment tokens. The flaw is categorized under [CWE-862: Missing Authorization].

Critical Impact
Unauthenticated attackers can overwrite payment gateway credentials, redirecting transaction handling and disrupting WooCommerce payment processing.

Affected Products

iPOSpays Gateways WC plugin for WordPress versions ≤ 1.3.7
WooCommerce installations using the affected plugin
WordPress sites with the woocommerce_ipospays_settings option in use

Discovery Timeline

2026-05-12 - CVE-2026-4663 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-4663

Vulnerability Analysis

The plugin exposes a REST API route intended for administrative configuration without enforcing any authentication or authorization controls. WordPress allows route registration to specify a permission_callback, which the framework invokes before executing the route handler. When this callback returns true unconditionally, every request, including anonymous ones, is treated as authorized.

The affected route, /wp-json/ipospays/v1/save_settings, writes directly to the woocommerce_ipospays_settings option. Attackers can submit crafted requests to modify live API keys, secret keys, and payment tokens. This compromises the integrity of payment processing for the WooCommerce store.

Root Cause

The root cause is the assignment of __return_true to the permission_callback parameter during REST route registration. This pattern disables WordPress's built-in capability enforcement. The handler also omits nonce verification, eliminating CSRF protection as a secondary control. See the plugin source at lines 253, 336, and 381 of class-ftd-redirect-gateway.php.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker sends an HTTP POST request to the exposed REST endpoint with arbitrary settings values. The plugin accepts and persists the payload to the WordPress options table. Refer to the Wordfence Vulnerability Report for additional analysis.

No verified public proof-of-concept code is available at this time. The exploitation pattern follows standard REST API abuse: unauthenticated POST requests to the save_settings route with attacker-controlled JSON payloads targeting payment configuration keys.

Detection Methods for CVE-2026-4663

Indicators of Compromise

Unauthenticated HTTP POST requests to /wp-json/ipospays/v1/save_settings in web server access logs
Unexpected modifications to the woocommerce_ipospays_settings option in the wp_options table
API keys, secret keys, or payment tokens in woocommerce_ipospays_settings differing from administrator-configured values

Detection Strategies

Audit WordPress REST API request logs for traffic to ipospays/v1/save_settings originating from non-administrator sessions
Monitor database writes to the wp_options row where option_name = 'woocommerce_ipospays_settings'
Inspect installed plugin versions across the WordPress fleet for ipospays-gateways-wc at or below 1.3.7

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for query against REST endpoint patterns
Configure alerts on configuration changes to WooCommerce payment gateway settings outside maintenance windows
Track outbound payment transaction destinations for deviation from approved processor endpoints

How to Mitigate CVE-2026-4663

Immediate Actions Required

Identify all WordPress installations running iPOSpays Gateways WC plugin version 1.3.7 or earlier
Disable the plugin until a patched release is installed and verified
Rotate all iPOSpays live API keys, secret keys, and payment tokens after confirming integrity of stored settings
Review recent WooCommerce transactions for anomalous routing or failures consistent with credential tampering

Patch Information

No fixed version is referenced in the published advisory at the time of NVD publication on 2026-05-12. Monitor the Wordfence Vulnerability Report and the WordPress plugin repository for an updated release that adds a proper permission_callback and capability check.

Workarounds

Block external access to /wp-json/ipospays/v1/save_settings at the web application firewall or reverse proxy layer
Restrict the WordPress REST API namespace ipospays/v1 to authenticated administrator sessions using server-level access controls
Deactivate the iPOSpays Gateways WC plugin and route payments through an alternative gateway until a patch is available

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location ~ ^/wp-json/ipospays/v1/save_settings {
    deny all;
    return 403;
}