CVE-2026-85632: Unauthenticated Payment Status Manipulation in Sipay Electronic Money's WordPress (WooCommerce)

Published Nov 11, 2026

Updated

Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle.

This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.

Event History

Nov 11, 2026

CVE Published

via MITRE·02:24 PM

Data Sourced

via MITRE·02:24 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

WooCommerce Virtual POS Module versions from 26.8.3 before 26.9.1 are affected. The provided information does not identify any other affected versions or products.

What does an attacker need to exploit this issue?

The severity vector indicates network access, low attack complexity, no privileges, and no user interaction. The description states exploitation involves a man-in-the-middle position to manipulate application API messages.

What is the potential impact?

An attacker may bypass authentication and manipulate payment-status-related application API messages. The CVSS vector rates confidentiality and integrity impact as high, with no availability impact indicated.

CVE-2026-85632: Unauthenticated Payment Status Manipulation in Sipay Electronic Money's WordPress (WooCommerce)

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the potential impact?