CVE-2026-78361: zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion
The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0, and take the site offline.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress pluginto a version that resolves this vulnerability.Fixed in 2.4.0 - Compensating control
Ensure unauthenticated users cannot access the affected front-end request handler endpoints (e.g., block/limit these routes at the web server/WAF until the plugin is upgraded to 2.4.0).
- Operational
Audit and restore any WordPress options that may have been deleted via the vulnerability, including any configuration or access-control settings, and verify zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin instances were not deactivated.
Event History
Frequently Asked Questions
Which installations are exposed?
WordPress sites running a zipMoney(Zip Co) Payments Plugin for WooCommerce version earlier than 2.4.0 are affected. The issue is in a front-end request handler, so exposure does not depend on an attacker having a WordPress account.
What does an attacker need to exploit this issue?
An attacker only needs to be able to send requests to the affected front-end handler. No authentication is required, and the attacker can supply the name of the WordPress option to delete.
What is the practical impact of successful exploitation?
An attacker can delete arbitrary WordPress options, including configuration and access-control settings. This may destroy site configuration, deactivate installed plugins, or take the site offline.