CVE-2026-86791: iPOSpays WooCommerce Auth Bypass Vulnerability

CVE-2026-86791 Overview

CVE-2026-86791 is a payment verification bypass in the iPOSpays Payment Gateway for WooCommerce WordPress plugin before version 1.4.7. The plugin fails to confirm that a payment transaction actually completed before recording a WooCommerce order as paid. Unauthenticated attackers can mark any unpaid order as paid and rewrite the order total. The flaw is classified under CWE-345: Insufficient Verification of Data Authenticity and affects storefronts that rely on the plugin for payment capture confirmation.

Critical Impact

Unauthenticated attackers can fraudulently mark WooCommerce orders as paid and manipulate order totals, allowing goods or services to be released without payment.

Affected Products

• iPOSpays Payment Gateway for WooCommerce WordPress plugin versions prior to 1.4.7
• WooCommerce storefronts using the iPOSpays gateway for payment capture
• WordPress sites exposing the plugin's payment callback endpoint to the internet

Discovery Timeline

• 2026-10-19 - CVE-2026-86791 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-86791

Vulnerability Analysis

The iPOSpays Payment Gateway for WooCommerce plugin exposes a payment confirmation flow that trusts client-supplied data rather than independently verifying the transaction with the iPOSpays processor. When a payment callback arrives, the plugin updates the WooCommerce order status to paid and accepts the submitted order total without cryptographic validation or an out-of-band processor lookup. This is a business logic flaw rooted in insufficient verification of data authenticity.

Because the endpoint is reachable without authentication, any remote actor can craft a request that marks arbitrary unpaid orders as paid. The attacker can also rewrite the order total, which affects accounting records, fulfillment triggers, and downstream reporting. The vulnerability does not expose confidential data, but it directly undermines transaction integrity on affected stores.

Root Cause

The root cause is missing server-side verification of the payment outcome. The plugin does not call back to the iPOSpays API to confirm the transaction state and does not validate a signed message or shared-secret HMAC on the inbound callback. The code path that transitions the WooCommerce order to a paid state executes on the basis of request parameters alone.

Attack Vector

The attack is executed over the network against the plugin's public payment handler. An unauthenticated attacker sends a crafted HTTP request referencing a target order_id and a chosen total. The plugin processes the request, marks the order as paid, and rewrites the total field. The attack requires no user interaction and no prior access to the store. See the WPScan Vulnerability Detail for the disclosure record.

// No verified exploit code is available for CVE-2026-86791.
// The vulnerability is triggered by an unauthenticated HTTP request
// to the plugin's payment confirmation endpoint, carrying an
// attacker-chosen order identifier and total.

Detection Methods for CVE-2026-86791

Indicators of Compromise

• WooCommerce orders transitioning to completed or processing status without a matching authorization record in the iPOSpays merchant portal.
• Order totals that differ between the WooCommerce database and the iPOSpays processor settlement reports.
• Repeated unauthenticated POST requests to the iPOSpays plugin callback URL from a single IP or user agent.

Detection Strategies

• Reconcile every WooCommerce order marked as paid against iPOSpays settlement data on a daily basis and flag mismatches.
• Alert on orders where the recorded total changes after the initial creation event, especially when the change is tied to a public endpoint request.
• Deploy web application firewall rules that log and rate-limit anonymous POSTs to the plugin's payment handler path.

Monitoring Recommendations

• Enable verbose WooCommerce order status change logging and ship events to a central SIEM for correlation.
• Monitor plugin version inventory across managed WordPress sites to identify installations below 1.4.7.
• Track fulfillment and refund events for anomalies that correlate with manipulated order totals.

How to Mitigate CVE-2026-86791

Immediate Actions Required

• Upgrade the iPOSpays Payment Gateway for WooCommerce plugin to version 1.4.7 or later on all affected WordPress sites.
• Audit WooCommerce orders created since the plugin was installed and reconcile each paid order with iPOSpays processor records.
• Temporarily disable the iPOSpays gateway if an immediate upgrade is not possible and route checkout through an alternative verified gateway.

Patch Information

The vendor addressed the vulnerability in iPOSpays Payment Gateway for WooCommerce version 1.4.7. The fixed release introduces server-side verification of the payment status before an order is marked as paid. Review the WPScan Vulnerability Detail for advisory references.

Workarounds

• Restrict access to the plugin's payment callback endpoint using a web application firewall rule that only permits requests from published iPOSpays processor IP ranges.
• Require manual order review for orders above a defined monetary threshold until the patch is applied.
• Disable automatic fulfillment triggers tied to WooCommerce order status transitions while remediation is in progress.

# Example WP-CLI commands to inventory and upgrade the plugin
wp plugin list --name=ipospays-payment-gateway-for-woocommerce --fields=name,status,version
wp plugin update ipospays-payment-gateway-for-woocommerce --version=1.4.7