CVE-2026-4663: iPOSpays Gateways WC <= 1.3.7 - Unauthenticated Missing Authorization to Settings Update via REST API Endpoint
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4663?
CVE-2026-4663 has a high severity due to its potential for unauthenticated access to sensitive settings via the REST API.
How do I fix CVE-2026-4663?
To fix CVE-2026-4663, update the iPOSpays Gateways WC plugin to version 1.3.8 or later.
What versions of iPOSpays Gateways WC are affected by CVE-2026-4663?
CVE-2026-4663 affects all versions of iPOSpays Gateways WC up to and including 1.3.7.
What type of vulnerability is CVE-2026-4663?
CVE-2026-4663 is classified as a missing authorization vulnerability.
What is the impact of CVE-2026-4663 on WordPress sites?
The impact of CVE-2026-4663 on WordPress sites includes unauthorized access and potential alteration of settings through the REST API.