CVE-2026-78361: WooCommerce Zip Payments Auth Bypass Flaw

CVE-2026-78361 Overview

CVE-2026-78361 affects the zipMoney (Zip Co) Payments Plugin for WooCommerce for WordPress in versions before 2.4.0. The plugin exposes a front-end request handler that performs no authorization checks and does not restrict which option name a caller may supply. Unauthenticated attackers can invoke this handler to delete arbitrary entries from the WordPress wp_options table. Deleting core options destroys site and access control configuration, disables active plugins, and can take the site fully offline. The vulnerability class maps to Broken Access Control and Missing Authorization.

Critical Impact
Any unauthenticated remote attacker can permanently delete arbitrary WordPress options, disabling the affected plugin, breaking site configuration, and rendering the WooCommerce store inoperable.

Affected Products

zipMoney (Zip Co) Payments Plugin for WooCommerce for WordPress, all versions before 2.4.0
WordPress sites running WooCommerce with the affected plugin activated
Merchant environments that expose the plugin's front-end AJAX handlers to unauthenticated traffic

Discovery Timeline

2026-09-10 - CVE-2026-78361 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78361

Vulnerability Analysis

The vulnerability resides in a front-end request handler shipped with the zipMoney (Zip Co) Payments Plugin for WooCommerce. The handler is reachable without authentication, typically through the WordPress admin-ajax.php endpoint used for unauthenticated nopriv actions. It accepts an option name from user-controlled request parameters and passes it to WordPress option-management functions without validation. As a result, an unauthenticated attacker can request deletion of any option stored in the wp_options table, including siteurl, home, template, stylesheet, active_plugins, and wp_user_roles. Removing these entries corrupts site configuration, deactivates every installed plugin, and can strip role definitions, effectively taking the site offline.

Root Cause

The root cause is a combination of missing authorization enforcement and missing input allow-listing on a public request handler. The handler does not verify the caller with is_user_logged_in(), current_user_can(), or a valid nonce via check_ajax_referer(). It also fails to restrict the option_name parameter to a fixed set of plugin-owned keys before passing it to WordPress option APIs.

Attack Vector

Exploitation requires only network access to the WordPress site and knowledge of the vulnerable action name. An attacker sends a crafted HTTP POST request to the plugin's public AJAX handler with an arbitrary option name in the request body. No authentication, user interaction, or elevated privileges are required. Refer to the WPScan Vulnerability Report for technical details on the vulnerable request handler and parameter names.

No verified proof-of-concept code is published in the enriched data for this CVE. The vulnerability mechanism is a missing capability and nonce check on a front-end AJAX handler that forwards an attacker-supplied option name to WordPress option-deletion functions.

Detection Methods for CVE-2026-78361

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing the zipMoney (Zip Co) plugin action from external IP addresses.
WordPress sites that suddenly load a default theme, lose active plugins, or return database errors referencing missing options.
wp_options table entries such as siteurl, home, active_plugins, template, or stylesheet being absent or reset.
Web server access logs showing repeated admin-ajax.php requests with an option_name or similar parameter supplying core WordPress keys.

Detection Strategies

Inspect WAF and reverse-proxy logs for unauthenticated calls to plugin AJAX actions containing option-name parameters that match sensitive wp_ keys.
Enable WordPress audit logging to record option changes and deletions, and alert on deletions performed by unauthenticated sessions.
Compare a known-good snapshot of the wp_options table against the running database and flag missing rows.

Monitoring Recommendations

Alert on any HTTP request to admin-ajax.php from unauthenticated clients that includes core WordPress option names in the body.
Monitor site availability, template rendering, and plugin state for unexpected changes indicating option tampering.
Track outbound WooCommerce order flow to detect payment plugin deactivation caused by removal of active_plugins.

How to Mitigate CVE-2026-78361

Immediate Actions Required

Update the zipMoney (Zip Co) Payments Plugin for WooCommerce to version 2.4.0 or later on all WordPress sites.
If the plugin is not actively used, deactivate and remove it from the WordPress installation.
Take a verified backup of the WordPress database, especially the wp_options table, before applying updates.
Review site logs for prior exploitation attempts and restore any deleted options from backup.

Patch Information

The vendor addressed the issue in version 2.4.0 of the zipMoney (Zip Co) Payments Plugin for WooCommerce. Administrators should upgrade all affected sites to 2.4.0 or later. See the WPScan Vulnerability Report for the fixed-version reference.

Workarounds

Block unauthenticated requests to the vulnerable plugin AJAX action at the web application firewall until the update is applied.
Restrict access to /wp-admin/admin-ajax.php for the vulnerable action name using server-level rules such as mod_rewrite or Nginx location blocks.
Temporarily deactivate the plugin site-wide if the update cannot be deployed immediately.
Enforce IP allow-listing for administrative and checkout endpoints where feasible.

bash

# Example Nginx rule to block the vulnerable action pending patch
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "zipmoney") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}